CVE-2026-8745 Overview
CVE-2026-8745 is a denial of service vulnerability affecting Open5GS versions up to 2.7.7. The flaw resides in the ogs_timer_add function within /src/ausf/nausf-handler.c, part of the Authentication Server Function (AUSF) component. An authenticated remote attacker can trigger the condition over the network to disrupt service availability. A public exploit reference exists, and the project was notified through a GitHub issue but has not responded at the time of publication. The vulnerability is classified under [CWE-404] (Improper Resource Shutdown or Release).
Critical Impact
Remote attackers with low privileges can disrupt the AUSF component of Open5GS deployments, impairing 5G core network authentication services.
Affected Products
- Open5GS versions up to and including 2.7.7
- Open5GS AUSF component (/src/ausf/nausf-handler.c)
- Deployments using the affected ogs_timer_add function path
Discovery Timeline
- 2026-05-17 - CVE-2026-8745 published to NVD
- 2026-05-18 - Last updated in NVD database
Technical Details for CVE-2026-8745
Vulnerability Analysis
Open5GS is an open-source implementation of 4G and 5G core network elements. The AUSF (Authentication Server Function) handles subscriber authentication in 5G service-based architectures. CVE-2026-8745 affects the ogs_timer_add call path within nausf-handler.c, where improper resource handling enables remote attackers to induce a denial of service condition.
The weakness is categorized as [CWE-404] Improper Resource Shutdown or Release. This class of defect typically arises when allocated resources such as timers, memory, or sockets are not consistently released across all execution paths. Repeated triggering of the affected handler can exhaust resources or destabilize the AUSF process.
The EPSS score is 0.041% at the 12.269 percentile, reflecting low observed exploitation likelihood. However, the public availability of exploit details elevates the operational risk for exposed Open5GS deployments.
Root Cause
The root cause lies in how ogs_timer_add is invoked within the AUSF handler logic. Improper management of timer resources in nausf-handler.c allows an attacker-controlled request flow to leave resources in an inconsistent state, ultimately leading to service disruption.
Attack Vector
The attack vector is network-based and requires low-level privileges on the service-based interface. An attacker who can reach the AUSF endpoint can submit crafted requests that traverse the vulnerable handler code path. No user interaction is required.
No verified proof-of-concept code is published in this advisory data. Refer to the GitHub Issue #4472 and the VulDB entry #364332 for the original problem report and technical context.
Detection Methods for CVE-2026-8745
Indicators of Compromise
- Unexpected restarts or crashes of the Open5GS AUSF process
- Abnormal growth in timer or memory consumption on hosts running the AUSF
- Repeated authentication-related requests from a single source preceding service degradation
Detection Strategies
- Monitor AUSF process health and service-based interface (SBI) endpoint availability for anomalies
- Inspect Open5GS logs for repeated handler errors in nausf-handler.c execution paths
- Correlate 5G core authentication failures with network-level patterns indicating request flooding against the AUSF
Monitoring Recommendations
- Enable verbose logging for the AUSF component and forward logs to a centralized analytics platform
- Track CPU, memory, and file descriptor utilization on AUSF hosts to identify resource exhaustion trends
- Alert on sudden drops in successful 5G subscriber authentications, which may indicate AUSF unavailability
How to Mitigate CVE-2026-8745
Immediate Actions Required
- Restrict network access to the AUSF service-based interface to trusted 5G core network functions only
- Apply rate limiting and ingress filtering in front of the AUSF endpoint to limit abusive request volumes
- Monitor the Open5GS GitHub repository for an upstream fix and track Issue #4472
Patch Information
At the time of publication, the Open5GS project has not released a patch addressing CVE-2026-8745. The vulnerability affects all versions up to and including 2.7.7. Operators should subscribe to the project's release notifications and apply the fix as soon as it becomes available.
Workarounds
- Deploy the AUSF behind a service mesh or API gateway that enforces authentication and request throttling
- Segment the 5G core network so that only authorized network functions can reach the AUSF endpoint
- Implement automated process supervision to restart the AUSF service if it terminates unexpectedly
# Example: restrict access to the AUSF SBI port using iptables
# Replace <trusted_subnet> and <ausf_port> with actual values from your deployment
iptables -A INPUT -p tcp --dport <ausf_port> -s <trusted_subnet> -j ACCEPT
iptables -A INPUT -p tcp --dport <ausf_port> -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
