CVE-2026-10565

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-10565", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "state": "PUBLISHED", "assignerShortName": "VulDB", "dateReserved": "2026-06-01T16:31:37.602Z", "datePublished": "2026-06-02T01:30:09.909Z", "dateUpdated": "2026-10-21T09:02:05.612Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-10-21T09:02:05.612Z"}, "title": "Open5GS NGAP Handover gmm-sm.c gmm_state_security_mode race condition", "problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-362", "lang": "en", "description": "Race Condition"}]}], "affected": [{"vendor": "n/a", "product": "Open5GS", "versions": [{"version": "2.7.0", "status": "affected"}, {"version": "2.7.1", "status": "affected"}, {"version": "2.7.2", "status": "affected"}, {"version": "2.7.3", "status": "affected"}, {"version": "2.7.4", "status": "affected"}, {"version": "2.7.5", "status": "affected"}, {"version": "2.7.6", "status": "affected"}], "cpes": ["cpe:2.3:a:open5gs:open5gs:*:*:*:*:*:*:*:*"], "modules": ["NGAP Handover"]}], "descriptions": [{"lang": "en", "value": "A security flaw has been discovered in Open5GS up to 2.7.6. The impacted element is the function gmm_state_security_mode of the file src/amf/gmm-sm.c of the component NGAP Handover. Performing a manipulation results in race condition. The attack can be initiated remotely. The complexity of an attack is rather high. The exploitability is regarded as difficult. The exploit has been released to the public and may be used for attacks. The pull request to fix this issue awaits acceptance."}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 2.3, "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P", "baseSeverity": "LOW"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 3.1, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:C", "baseSeverity": "LOW"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 3.1, "vectorString": "CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:C", "baseSeverity": "LOW"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 2.1, "vectorString": "AV:N/AC:H/Au:S/C:N/I:N/A:P/E:POC/RL:ND/RC:C"}}], "timeline": [{"time": "2026-06-01T00:00:00.000Z", "lang": "en", "value": "Advisory disclosed"}, {"time": "2026-06-01T02:00:00.000Z", "lang": "en", "value": "VulDB entry created"}, {"time": "2026-10-21T11:06:55.000Z", "lang": "en", "value": "VulDB entry last update"}], "credits": [{"lang": "en", "value": "Seungjoon Na (Kookmin University ICSR Lab)", "type": "finder"}, {"lang": "en", "value": "Jinha Kim (Kookmin University ICSR Lab)", "type": "finder"}, {"lang": "en", "value": "Hwankuk Kim (Kookmin University ICSR Lab)", "type": "finder"}, {"lang": "en", "value": "Seungjoon Na (VulDB User)", "type": "reporter"}, {"lang": "en", "value": "Seungjoon Na (VulDB User)", "type": "analyst"}, {"lang": "en", "value": "VulDB CNA Team", "type": "coordinator"}], "references": [{"url": "https://vuldb.com/vuln/367672", "name": "VDB-367672 | Open5GS NGAP Handover gmm-sm.c gmm_state_security_mode race condition", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/vuln/367672/cti", "name": "VDB-367672 | CTI Indicators (IOB, IOC, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/cve/CVE-2026-10565", "name": "CVE-2026-10565 | CVE Analysis and Report", "tags": ["third-party-advisory"]}, {"url": "https://vuldb.com/submit/818938", "name": "Submit #818938 | open5gs v2.7.6 Race Condition", "tags": ["third-party-advisory"]}, {"url": "https://github.com/open5gs/open5gs/issues/4497", "tags": ["issue-tracking"]}, {"url": "https://github.com/open5gs/open5gs/pull/4501", "tags": ["issue-tracking", "patch"]}, {"url": "https://github.com/user-attachments/files/27111025/N2-SMC-Concurrent.zip", "tags": ["exploit"]}, {"url": "https://github.com/open5gs/open5gs/", "tags": ["product"]}], "x_generator": ["VulDB PVTS v202610"]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-06-02T12:22:40.203143Z", "id": "CVE-2026-10565", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-02T12:22:53.847Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-10565", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-02T12:22:40.203143Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-02T12:22:47.504Z"}}], "cna": {"title": "Open5GS NGAP Handover gmm-sm.c gmm_state_security_mode race condition", "credits": [{"lang": "en", "type": "finder", "value": "Seungjoon Na (Kookmin University ICSR Lab)"}, {"lang": "en", "type": "finder", "value": "Jinha Kim (Kookmin University ICSR Lab)"}, {"lang": "en", "type": "finder", "value": "Hwankuk Kim (Kookmin University ICSR Lab)"}, {"lang": "en", "type": "reporter", "value": "Seungjoon Na (VulDB User)"}, {"lang": "en", "type": "analyst", "value": "Seungjoon Na (VulDB User)"}, {"lang": "en", "type": "coordinator", "value": "VulDB CNA Team"}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 2.3, "baseSeverity": "LOW", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 3.1, "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:C"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 3.1, "baseSeverity": "LOW", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:C"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 2.1, "vectorString": "AV:N/AC:H/Au:S/C:N/I:N/A:P/E:POC/RL:ND/RC:C"}}], "affected": [{"cpes": ["cpe:2.3:a:open5gs:open5gs:*:*:*:*:*:*:*:*"], "vendor": "n/a", "modules": ["NGAP Handover"], "product": "Open5GS", "versions": [{"status": "affected", "version": "2.7.0"}, {"status": "affected", "version": "2.7.1"}, {"status": "affected", "version": "2.7.2"}, {"status": "affected", "version": "2.7.3"}, {"status": "affected", "version": "2.7.4"}, {"status": "affected", "version": "2.7.5"}, {"status": "affected", "version": "2.7.6"}]}], "timeline": [{"lang": "en", "time": "2026-06-01T00:00:00.000Z", "value": "Advisory disclosed"}, {"lang": "en", "time": "2026-06-01T02:00:00.000Z", "value": "VulDB entry created"}, {"lang": "en", "time": "2026-10-21T11:06:55.000Z", "value": "VulDB entry last update"}], "references": [{"url": "https://vuldb.com/vuln/367672", "name": "VDB-367672 | Open5GS NGAP Handover gmm-sm.c gmm_state_security_mode race condition", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/vuln/367672/cti", "name": "VDB-367672 | CTI Indicators (IOB, IOC, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/cve/CVE-2026-10565", "name": "CVE-2026-10565 | CVE Analysis and Report", "tags": ["third-party-advisory"]}, {"url": "https://vuldb.com/submit/818938", "name": "Submit #818938 | open5gs v2.7.6 Race Condition", "tags": ["third-party-advisory"]}, {"url": "https://github.com/open5gs/open5gs/issues/4497", "tags": ["issue-tracking"]}, {"url": "https://github.com/open5gs/open5gs/pull/4501", "tags": ["issue-tracking", "patch"]}, {"url": "https://github.com/user-attachments/files/27111025/N2-SMC-Concurrent.zip", "tags": ["exploit"]}, {"url": "https://github.com/open5gs/open5gs/", "tags": ["product"]}], "x_generator": ["VulDB PVTS v202610"], "descriptions": [{"lang": "en", "value": "A security flaw has been discovered in Open5GS up to 2.7.6. The impacted element is the function gmm_state_security_mode of the file src/amf/gmm-sm.c of the component NGAP Handover. Performing a manipulation results in race condition. The attack can be initiated remotely. The complexity of an attack is rather high. The exploitability is regarded as difficult. The exploit has been released to the public and may be used for attacks. The pull request to fix this issue awaits acceptance."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-362", "description": "Race Condition"}]}], "providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-10-21T09:02:05.612Z"}}}, "cveMetadata": {"cveId": "CVE-2026-10565", "state": "PUBLISHED", "dateUpdated": "2026-10-21T09:02:05.612Z", "dateReserved": "2026-06-01T16:31:37.602Z", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "datePublished": "2026-06-02T01:30:09.909Z", "assignerShortName": "VulDB"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"cpes": ["cpe:2.3:a:open5gs:open5gs:*:*:*:*:*:*:*:*"], "modules": ["NGAP Handover"], "product": "Open5GS", "vendor": "n/a", "versions": [{"status": "affected", "version": "2.7.0"}, {"status": "affected", "version": "2.7.1"}, {"status": "affected", "version": "2.7.2"}, {"status": "affected", "version": "2.7.3"}, {"status": "affected", "version": "2.7.4"}, {"status": "affected", "version": "2.7.5"}, {"status": "affected", "version": "2.7.6"}]}], "source": "cna@vuldb.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A security flaw has been discovered in Open5GS up to 2.7.6. The impacted element is the function gmm_state_security_mode of the file src/amf/gmm-sm.c of the component NGAP Handover. Performing a manipulation results in race condition. The attack can be initiated remotely. The complexity of an attack is rather high. The exploitability is regarded as difficult. The exploit has been released to the public and may be used for attacks. The pull request to fix this issue awaits acceptance."}, {"lang": "es", "value": "Una falla de seguridad ha sido descubierta en Open5GS hasta la versi\u00f3n 2.7.6. El elemento afectado es la funci\u00f3n gmm_state_security_mode del archivo src/amf/gmm-sm.c del componente NGAP Handover. Realizar una manipulaci\u00f3n resulta en una condici\u00f3n de carrera. El ataque puede ser iniciado de forma remota. La complejidad de un ataque es bastante alta. La explotabilidad se considera dif\u00edcil. El exploit ha sido publicado y puede ser utilizado para ataques. La pull request para solucionar este problema espera ser aceptada."}], "id": "CVE-2026-10565", "lastModified": "2026-07-22T19:10:00.120", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "LOW", "cvssData": {"accessComplexity": "HIGH", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "PARTIAL", "baseScore": 2.1, "confidentialityImpact": "NONE", "integrityImpact": "NONE", "vectorString": "AV:N/AC:H/Au:S/C:N/I:N/A:P", "version": "2.0"}, "exploitabilityScore": 3.9, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "cna@vuldb.com", "type": "Secondary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 3.1, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L", "version": "3.1"}, "exploitabilityScore": 1.6, "impactScore": 1.4, "source": "cna@vuldb.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "HIGH", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 1.3, "baseSeverity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "PROOF_OF_CONCEPT", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cna@vuldb.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-10565", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-06-02T12:22:40.203143Z", "version": "2.0.3"}}]}, "published": "2026-06-02T03:16:16.053", "references": [{"source": "cna@vuldb.com", "url": "https://github.com/open5gs/open5gs/"}, {"source": "cna@vuldb.com", "url": "https://github.com/open5gs/open5gs/issues/4497"}, {"source": "cna@vuldb.com", "url": "https://github.com/open5gs/open5gs/pull/4501"}, {"source": "cna@vuldb.com", "url": "https://github.com/user-attachments/files/27111025/N2-SMC-Concurrent.zip"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/cve/CVE-2026-10565"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/submit/818938"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/367672"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/367672/cti"}], "sourceIdentifier": "cna@vuldb.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-362"}], "source": "cna@vuldb.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[2.7.0,2.7.6]"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Open5GS", "source": "cna", "vendor": "n/a"}, "product": "open5gs", "vendor": "open5gs"}], "created": "2026-06-02T03:30:25.880851+00:00", "updated": "2026-06-02T03:30:26.148149+00:00", "vendors": ["open5gs", "open5gs$PRODUCT$open5gs"]}