CVE-2026-30045

CVE-2026-30045 is an integer overflow (CWE-190) in the /nnrf-disc/v1/nf-instances component of Open5GS v2.7.6, the open-source 4G/5G core's Network Repository Function (NRF) that handles network-function discovery. An attacker can trigger it by sending a single crafted HTTP/2 GET request to the NF-discovery endpoint on the service-based-interface (SBI) listener. The successful request crashes the affected component, causing a denial of service that can disrupt network-function discovery and degrade the core network; there is no confidentiality or integrity impact per the CVSS vector. Anyone running Open5GS v2.7.6 with the NRF discovery service reachable over HTTP/2 is affected — typically private 5G network operators, labs, and research deployments — and no authentication is required. As of this analysis there is no known public proof-of-concept, the flaw is not in the CISA KEV catalog, and its EPSS score (0.4%, ~33rd percentile) suggests a low near-term probability of exploitation.

What to do: Upgrade Open5GS to the latest release that fixes this issue (the advisory names v2.7.6 as affected; check the Open5GS changelog/GitHub advisories for the fixed version). In the interim, restrict access to the NRF/SBI HTTP/2 listener (the service-based interface, typically not meant for untrusted networks) using firewall or ACL rules so only trusted network functions can reach /nnrf-disc/v1/nf-instances. Monitor 5G core logs for unexpected NRF process crashes or malformed HTTP/2 GET requests against the discovery endpoint.