CVE-2026-82588: Open5GS Null Pointer Dereference DOS Vulnerability

CVE-2026-82588 Overview

CVE-2026-82588 is a null pointer dereference vulnerability in Open5GS versions up to 2.7.7. The flaw resides in the src/amf/namf-handler.c source file within the Transfer Endpoint component of the Access and Mobility Management Function (AMF). Remote attackers with low privileges can trigger the condition over the network without user interaction. Successful exploitation causes the affected process to crash, resulting in denial of service for 5G core network signaling. The Open5GS project addressed the issue in version 2.8.0 via commit abf8a836564b966b5141110fc25ed413c4f17522.

Critical Impact
Remote attackers can crash the Open5GS AMF process, disrupting 5G core mobility signaling and denying service to connected subscribers.

Affected Products

Open5GS versions up to and including 2.7.7
Open5GS AMF Transfer Endpoint (src/amf/namf-handler.c)
Open5GS deployments not yet upgraded to release v2.8.0

Discovery Timeline

2026-08-30 - CVE-2026-82588 published to NVD
2026-09-01 - Last updated in NVD database

Technical Details for CVE-2026-82588

Vulnerability Analysis

The vulnerability is a null pointer dereference [CWE-404: Improper Resource Shutdown or Release] in the Open5GS AMF component. The AMF handles registration, connection, and mobility management for 5G subscribers, and its Namf service exposes HTTP/2 endpoints to other network functions. The affected handler in src/amf/namf-handler.c processes Transfer Endpoint messages without validating that all required pointer fields are populated. When a message with missing or malformed structure reaches the vulnerable path, the handler dereferences a null pointer and the AMF process terminates. Because the AMF is a central signaling function, its termination disrupts subscriber attach, handover, and paging operations across the served coverage area.

Root Cause

The root cause is missing validation of message fields before dereferencing pointer members returned by the Namf message parser. The fix in commit abf8a836564b966b5141110fc25ed413c4f17522 introduces the checks needed to reject or safely handle messages that omit the expected structures.

Attack Vector

The attack vector is network-based and requires low privileges consistent with a peer network function or an attacker able to reach the Namf HTTP/2 interface. No user interaction is required. An attacker submits a crafted request to the Transfer Endpoint that omits a field the handler assumes to be non-null. See the Open5GS Issue #4397 and the Open5GS Commit Details for the specific code path and remediation.

No verified public exploit code is available for this issue. Refer to the linked commit and issue for technical specifics.

Detection Methods for CVE-2026-82588

Indicators of Compromise

Unexpected termination or restart of the Open5GS amf process, with core dumps referencing namf-handler.c.
Segmentation fault entries in Open5GS logs correlated with inbound Namf Transfer Endpoint requests.
Sudden loss of AMF service availability to connected gNodeBs and interconnected network functions.

Detection Strategies

Monitor Open5GS AMF stdout, stderr, and systemd journal output for crash signatures and repeated restarts.
Inspect HTTP/2 traffic to Namf service endpoints for malformed or partial JSON bodies targeting Transfer operations.
Correlate AMF availability metrics with recent inbound requests to identify a triggering peer.

Monitoring Recommendations

Enable process supervision and alerting on AMF restart counters exceeding a defined threshold.
Capture Namf request logs including source network function identity for forensic review.
Track subscriber attach failure rates and paging error metrics as downstream indicators of AMF disruption.

How to Mitigate CVE-2026-82588

Immediate Actions Required

Upgrade Open5GS to version 2.8.0 or later, which contains commit abf8a836564b966b5141110fc25ed413c4f17522.
Restrict network reachability of the AMF Namf HTTP/2 interface to trusted 5G core network functions only.
Enable automatic process restart for the AMF service to reduce outage duration if a crash occurs.

Patch Information

The issue is fixed in Open5GS Release v2.8.0. The remediation is contained in the patch identified by commit hash abf8a836564b966b5141110fc25ed413c4f17522. Additional context is available in the VulDB CVE-2026-82588 advisory and the upstream Open5GS GitHub Repository.

Workarounds

Deploy network-layer access control lists that permit Namf traffic only from authorized network function peers.
Terminate service-based interface traffic through a validating reverse proxy that rejects malformed JSON payloads.
Run the AMF under a service manager configured to restart the process automatically on failure until the patch is applied.

bash

# Upgrade Open5GS to the fixed release
git clone https://github.com/open5gs/open5gs.git
cd open5gs
git checkout v2.8.0
meson build --prefix=`pwd`/install
ninja -C build install