CVE-2026-82589: Open5GS N1-N2 Message Handler DOS Vulnerability

CVE-2026-82589 Overview

CVE-2026-82589 is a denial of service vulnerability in Open5GS versions up to 2.7.7. The flaw resides in the amf_namf_comm_handle_n1_n2_message_transfer function within src/amf/namf-handler.c, part of the N1-N2 Message Handler component. Attackers can trigger the condition by manipulating the N1N2MessageTransferReqData.n2InfoContainer.smInfo.n2InfoContent.ngapIeType argument. The attack is remotely initiated and requires low privileges. Public exploit code has been released, though the vulnerability has not been observed in active exploitation. The issue is classified under CWE-404 (Improper Resource Shutdown or Release). Upgrading to Open5GS version 2.8.0 resolves the flaw.

Critical Impact
Remote attackers with low privileges can trigger a denial of service condition in the Access and Mobility Management Function (AMF) of Open5GS, disrupting 5G core network operations.

Affected Products

Open5GS versions up to and including 2.7.7
Open5GS AMF component (src/amf/namf-handler.c)
Open5GS N1-N2 Message Handler subsystem

Discovery Timeline

2026-08-30 - CVE-2026-82589 published to NVD
2026-08-31 - Last updated in NVD database

Technical Details for CVE-2026-82589

Vulnerability Analysis

Open5GS is an open-source implementation of the 5G Core and Evolved Packet Core (EPC). The vulnerability affects the Access and Mobility Management Function (AMF), which handles signaling between the 5G Radio Access Network (RAN) and the core network. The amf_namf_comm_handle_n1_n2_message_transfer function processes N1-N2 message transfer requests from the Session Management Function (SMF). When the function processes an attacker-controlled ngapIeType value within the nested n2InfoContent structure, improper resource handling leads to a service disruption condition. The AMF process becomes unable to continue serving legitimate signaling traffic, effectively halting 5G control-plane operations for connected subscribers.

Root Cause

The underlying weakness is categorized as CWE-404, Improper Resource Shutdown or Release. The N1-N2 handler fails to correctly validate or release resources when parsing malformed values in the ngapIeType field of an incoming N1N2MessageTransferReqData structure. The fix is committed in GitHub Commit abf8a836564 and released in Open5GS v2.8.0.

Attack Vector

Exploitation requires network access to the Service-Based Interface (SBI) exposed by the AMF and a low-privilege position sufficient to issue a Namf_Communication N1N2MessageTransfer request. An attacker constructs a request with a manipulated ngapIeType field inside N1N2MessageTransferReqData.n2InfoContainer.smInfo.n2InfoContent. Delivering the crafted request to the AMF triggers the resource-handling defect and interrupts service. Public exploit details are referenced in the GitHub Issue #4396 and VulDB CVE-2026-82589 entries.

No verified proof-of-concept code is reproduced here. Refer to the upstream references for technical exploitation details.

Detection Methods for CVE-2026-82589

Indicators of Compromise

Unexpected AMF process crashes, restarts, or unresponsiveness within the 5G core following inbound SBI traffic
Malformed Namf_Communication N1N2MessageTransfer requests containing unusual or unexpected ngapIeType values
Loss of registration or session continuity for subscribers correlated with SBI request bursts from a single peer

Detection Strategies

Inspect SBI HTTP/2 traffic destined for the AMF for N1N2MessageTransferReqData payloads carrying anomalous ngapIeType values
Monitor Open5GS AMF logs for parser errors and abnormal termination events tied to amf_namf_comm_handle_n1_n2_message_transfer
Correlate control-plane availability metrics with source IP patterns on the SBI network segment

Monitoring Recommendations

Enable verbose logging on the AMF and forward events to a central analytics platform for correlation
Baseline normal SMF-to-AMF N1N2 message rates and alert on deviations that align with service degradation
Track version metadata across Open5GS deployments to identify hosts still running builds at or below 2.7.7

How to Mitigate CVE-2026-82589

Immediate Actions Required

Upgrade Open5GS to version 2.8.0 or later as published in the GitHub Release v2.8.0
Restrict SBI network exposure so that only trusted network functions can reach the AMF Namf_Communication endpoint
Enforce mutual TLS and OAuth2 access tokens between 5G network functions to limit which peers can invoke N1N2MessageTransfer

Patch Information

The fix is applied in commit abf8a836564b966b5141110fc25ed413c4f17522 and shipped in Open5GS 2.8.0. Review the GitHub Commit abf8a836564 for the exact code change to src/amf/namf-handler.c.

Workarounds

Segment the SBI interface on a dedicated management network isolated from untrusted operators and tenants
Deploy an API gateway or service mesh policy that validates incoming Namf_Communication payload schemas before they reach the AMF
Rate-limit N1N2 message transfer requests per source network function to reduce blast radius from a malformed request storm

bash

# Upgrade Open5GS to the patched release
git clone https://github.com/open5gs/open5gs.git
cd open5gs
git checkout v2.8.0
meson build --prefix=`pwd`/install
ninja -C build
ninja -C build install

# Verify the deployed version
open5gs-amfd -v