CVE-2026-92416: Open5GS PFCP Handler RCE Vulnerability

CVE-2026-92416 Overview

CVE-2026-92416 is a reachable assertion vulnerability [CWE-617] in Open5GS through version 2.8.0. The flaw resides in the smf_n4_handle_session_report_request function within src/smf/n4-handler.c, part of the Packet Forwarding Control Protocol (PFCP) Session Report Request Handler. A remote attacker with low privileges can trigger the assertion by sending a malformed PFCP Session Report Request, causing the Session Management Function (SMF) to abort. The issue affects the availability of the mobile core network component. A patch is available in commit e5f0c06d0f2d9613b003daa1cfa3ba8a4bd157e9.

Critical Impact
A remote attacker can crash the Open5GS SMF process by sending malformed PFCP Session Report Requests, disrupting 5G/LTE session management for all subscribers served by the affected node.

Affected Products

Open5GS versions up to and including 2.8.0
Open5GS SMF component (src/smf/n4-handler.c)
PFCP Session Report Request Handler

Discovery Timeline

2026-09-16 - CVE-2026-92416 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-92416

Vulnerability Analysis

The vulnerability exists in the SMF component of Open5GS, an open source 5G Core and EPC implementation. The smf_n4_handle_session_report_request function processes PFCP Session Report Requests received over the N4 interface from the User Plane Function (UPF). When the request is malformed, the handler reaches an ogs_assert call path that aborts the SMF process instead of gracefully rejecting the message.

The result is a denial of service against the mobile core signaling plane. Because PFCP is a control protocol between SMF and UPF nodes, any attacker able to reach the N4 interface can repeatedly trigger the abort and prevent session establishment, modification, or termination for connected subscribers.

Root Cause

The root cause is improper input validation of PFCP Session Report Request messages combined with the use of assertion-based error handling in a network-facing code path. The pre-patch handler returned a uint8_t PFCP cause value, but malformed inputs reached an assertion before a cause could be assigned. Assertions are intended to catch programmer errors, not attacker-controlled protocol input, so any malformed packet path that reaches ogs_assert becomes a remotely reachable process abort.

Attack Vector

An attacker with network access to the N4 interface between SMF and UPF can send a crafted PFCP Session Report Request that triggers the assertion. Exploitation requires the ability to send PFCP traffic to the SMF listener, which corresponds to a low-privilege position on the operator's internal transport network. No user interaction is required. Successful exploitation aborts the SMF, dropping active PFCP sessions and blocking new ones until the process is restarted.

// Patch: src/smf/n4-handler.h
// Return type changed from uint8_t (PFCP cause) to bool so the handler
// can signal malformed input without asserting.
         smf_sess_t *sess, ogs_pfcp_xact_t *xact,
         ogs_pfcp_session_deletion_response_t *rsp);
 
-uint8_t smf_n4_handle_session_report_request(
+bool smf_n4_handle_session_report_request(
         smf_sess_t *sess, ogs_pfcp_xact_t *pfcp_xact,
         ogs_pfcp_session_report_request_t *pfcp_req);
// Source: https://github.com/open5gs/open5gs/commit/e5f0c06d0f2d9613b003daa1cfa3ba8a4bd157e9

// Patch: src/smf/gsm-sm.c
// The unused pfcp_cause local was removed as part of reworking the
// caller to handle a boolean success/failure result instead of a cause byte.
     ogs_pfcp_xact_t *pfcp_xact = NULL;
     ogs_pfcp_message_t *pfcp_message = NULL;
-    uint8_t pfcp_cause;
 
     ogs_diam_gy_message_t *gy_message = NULL;
     uint32_t diam_err;
// Source: https://github.com/open5gs/open5gs/commit/e5f0c06d0f2d9613b003daa1cfa3ba8a4bd157e9

Detection Methods for CVE-2026-92416

Indicators of Compromise

Unexpected termination or restart of the Open5GS smf process with abort or assertion messages in logs
Log entries referencing smf_n4_handle_session_report_request prior to a process exit
Loss of PFCP N4 associations between SMF and UPF, followed by mass session re-establishment attempts
Anomalous volume of PFCP Session Report Request messages from a single UPF or spoofed source

Detection Strategies

Monitor SMF process supervisor logs (systemd, container runtime) for repeated crash-restart cycles
Inspect PFCP traffic on the N4 interface for malformed Session Report Request messages using packet capture and dissectors such as Wireshark
Alert on assertion strings from ogs_assert originating in SMF n4-handler code paths

Monitoring Recommendations

Track SMF availability metrics and correlate outages with inbound PFCP message rates and sources
Baseline the ratio of PFCP Session Report Requests to active sessions and alert on deviations
Forward Open5GS logs to a centralized analytics platform to detect repeat abort signatures across nodes

How to Mitigate CVE-2026-92416

Immediate Actions Required

Apply Open5GS commit e5f0c06d0f2d9613b003daa1cfa3ba8a4bd157e9 or upgrade to a release that contains the fix
Restrict N4 interface reachability so that only trusted UPF nodes can send PFCP traffic to the SMF
Enable automatic process restart for the SMF service to minimize outage duration during triage
Review SMF logs for prior abort events that may indicate earlier exploitation attempts

Patch Information

The upstream fix is provided in Open5GS commit e5f0c06, titled "[SMF] Fix abort on malformed PFCP Session Report Request." The patch changes the return type of smf_n4_handle_session_report_request from uint8_t to bool and reworks callers so malformed input is rejected via a normal error path instead of an assertion. Additional context is available in Open5GS Issue #4744 and the Open5GS GitHub repository.

Workarounds

Enforce strict network segmentation and firewall rules on UDP port 8805 (PFCP) so only authorized UPF peers can reach the SMF
Deploy IPsec or equivalent transport authentication between SMF and UPF nodes to block spoofed PFCP senders
Configure service supervision to automatically restart the SMF process on abort while the patch is being rolled out

bash

# Restrict PFCP (UDP/8805) to trusted UPF peers only
sudo iptables -A INPUT -p udp --dport 8805 -s <trusted-upf-ip>/32 -j ACCEPT
sudo iptables -A INPUT -p udp --dport 8805 -j DROP

# Ensure SMF is auto-restarted on abort (systemd unit override)
sudo systemctl edit open5gs-smfd
# [Service]
# Restart=always
# RestartSec=2s