CVE-2026-82590: Open5GS SMF Component RCE Vulnerability

CVE-2026-82590 Overview

CVE-2026-82590 is a reachable assertion vulnerability [CWE-617] in Open5GS versions up to 2.7.7. The flaw resides in the smf_nudm_sdm_handle_get function within src/smf/nudm-handler.c, part of the Session Management Function (SMF) component. An attacker can trigger the assertion by manipulating the preemptCap argument in a 5G Quality of Service (QoS) profile. The attack is reachable over the network and results in process termination, disrupting 5G core session management. Open5GS resolved the issue in version 2.8.0 through commit 4554405f29bffd7562abedbee63484825bd90cd5.

Critical Impact
Remote attackers with low privileges can crash the Open5GS SMF process, causing denial of service against 5G core session establishment.

Affected Products

Open5GS versions up to and including 2.7.7
Open5GS SMF (Session Management Function) component
5G core deployments relying on nudm-handler.c request processing

Discovery Timeline

2026-08-30 - CVE-2026-82590 published to NVD
2026-08-31 - Last updated in NVD database

Technical Details for CVE-2026-82590

Vulnerability Analysis

The vulnerability is a reachable assertion in the Open5GS SMF, triggered while processing UDM Subscription Data Management (SDM) responses. When the SMF handles a 5G QoS profile carried in a nudm-sdm message, it inspects the Allocation and Retention Priority (ARP) preempt_cap field. The pre-patch logic asserted that sess->session.qos.arp.pre_emption_capability was non-zero after evaluating only two accepted enum values. Any other value left the capability unset and reached ogs_assert, terminating the SMF process. The result is a denial of service against 5G session establishment.

Root Cause

The root cause is missing input validation on the preempt_cap enumeration received from a peer network function. The code assumed the incoming value would be either OpenAPI_preemption_capability_MAY_PREEMPT or OpenAPI_preemption_capability_NOT_PREEMPT. Any unexpected value bypassed both branches, and the trailing ogs_assert on the still-zero field aborted the process. This pattern maps directly to CWE-617 (Reachable Assertion).

Attack Vector

The attack requires network reachability to the SMF and a way to influence a UDM SDM response containing a malformed 5G QoS profile with an out-of-range preemptCap. A malicious or compromised peer function, or an attacker positioned between service-based interface endpoints, can inject the manipulated value. Successful triggering terminates the SMF, stopping PDU session creation until the process restarts.

// Patch excerpt: src/smf/nudm-handler.c
// Replaces ogs_assert with explicit rejection of unexpected preempt_cap values
if (_5gQoSProfile->arp->preempt_cap ==
        OpenAPI_preemption_capability_MAY_PREEMPT) {
    sess->session.qos.arp.pre_emption_capability =
        OGS_5GC_PRE_EMPTION_ENABLED;
} else if (_5gQoSProfile->arp->preempt_cap ==
        OpenAPI_preemption_capability_NOT_PREEMPT) {
    sess->session.qos.arp.pre_emption_capability =
        OGS_5GC_PRE_EMPTION_DISABLED;
} else {
    ogs_error("[%s:%d] Invalid ARP preemptCap [%d]",
            smf_ue->supi, sess->psi,
            _5gQoSProfile->arp->preempt_cap);
    continue;
}

Source: GitHub Commit 4554405

Detection Methods for CVE-2026-82590

Indicators of Compromise

Unexpected SMF process crashes accompanied by ogs_assert abort messages in Open5GS logs.
Log entries referencing invalid ARP preemptCap values in nudm-handler.c after patch deployment.
Sudden loss of PDU session establishment across subscribers correlated with SMF restart events.

Detection Strategies

Monitor SMF service uptime and restart counters through the process supervisor or systemd journal.
Inspect nudm-sdm traffic for 5G QoS profiles carrying preemptCap values outside the defined enumeration.
Correlate UDM-to-SMF service-based interface flows with SMF termination events to identify malicious peers.

Monitoring Recommendations

Alert on repeated SMF crashes within short intervals, which indicate targeted assertion abuse.
Capture and retain SBI (Service Based Interface) HTTP/2 payloads for offline analysis of QoS parameter integrity.
Track subscriber-facing session establishment failure rates as a downstream signal of SMF disruption.

How to Mitigate CVE-2026-82590

Immediate Actions Required

Upgrade Open5GS to version 2.8.0 or later, which includes commit 4554405f29bffd7562abedbee63484825bd90cd5.
Restrict SMF service-based interface exposure to trusted UDM peers using network segmentation and mTLS.
Enable process supervision to automatically restart the SMF and preserve session continuity while patching is scheduled.

Patch Information

The fix is delivered in Open5GS Release v2.8.0 via commit 4554405f29bffd7562abedbee63484825bd90cd5. The patch replaces the trailing ogs_assert with explicit validation that logs an error and skips the malformed QoS entry. Additional context is available in GitHub Issue #4455 and the VulDB CVE-2026-82590 record.

Workarounds

Apply the upstream patch as an out-of-tree fix if an immediate 2.8.0 upgrade is not feasible.
Limit SBI reachability to authenticated 5G core network functions and drop unsolicited nudm-sdm traffic at the perimeter.
Deploy service-based interface inspection to filter QoS profiles containing out-of-range preemptCap values.

bash

# Verify installed Open5GS version and confirm patched build
open5gs-smfd -v
# Expected output should report version 2.8.0 or later
git -C /path/to/open5gs log --oneline | grep 4554405f29bffd7562abedbee63484825bd90cd5