CVE-2026-92417

Open5GS up to and including 2.8.0 contains a null pointer dereference (CWE-476) in ogs_pfcp_parse_volume_measurement in lib/pfcp/types.c, part of the PFCP message handler used by its 4G/5G core network functions. An attacker who can send crafted PFCP traffic to a vulnerable SMF or UPF can trigger the flaw remotely, causing the affected process to crash. Per the CVSS 4.0 score (7.1 High), the impact is high availability loss with no confidentiality or integrity impact, so the practical outcome is denial of service of core network elements. Any operator running Open5GS 2.8.0 or earlier is affected, particularly deployments where the PFCP endpoint (typically UDP 8805) is reachable from untrusted networks. No public proof-of-concept is known and the flaw is not listed in CISA KEV, so exploitation has not been confirmed.

What to do: Upgrade Open5GS to a release that includes the fix commit 8f07b507b78ff94776f2cd49276eb116ed93d7f2, or apply that commit to a 2.8.0 build. Until patched, firewall PFCP (UDP 8805) so only trusted SMF/UPF peers can reach it and restrict N4 interface exposure to management networks. Monitor SMF/UPF processes for unexplained crashes or restarts, which could indicate probing against this flaw.