CVE-2026-106807

{"dataType": "CVE_RECORD", "cveMetadata": {"state": "PUBLISHED", "cveId": "CVE-2026-106807", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "dateUpdated": "2026-11-02T16:15:23.096Z", "dateReserved": "2026-10-07T00:00:00.000Z", "datePublished": "2026-11-02T00:00:00.000Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2026-11-02T16:15:23.096Z"}, "descriptions": [{"lang": "en", "value": "A denial-of-service vulnerability exists in open5GS v2.8.0 in the PFCP transaction handling path. When the PFCP transaction or timer resource pool is exhausted, ogs_pfcp_xact_remote_create() returns NULL, but the failure is not handled properly and leads to an ogs_assert(new) failure in ogs_pfcp_xact_receive(). An attacker able to send PFCP messages to the affected SMF/UPF can exhaust transaction resources and cause the network function process to terminate with SIGABRT, resulting in service disruption and preventing further session establishment until the affected component is restarted."}], "affected": [{"vendor": "n/a", "product": "n/a", "versions": [{"version": "n/a", "status": "affected"}]}], "references": [{"url": "https://github.com/open5gs/open5gs/issues/4791"}, {"url": "https://github.com/open5gs/open5gs/commit/d91af3b0ac59f6e9dab25718ef4eed9cbf2813ca"}, {"url": "https://gist.github.com/hackeryounow/a453020171ed5bc36036fb05c5fd448e"}], "problemTypes": [{"descriptions": [{"type": "text", "lang": "en", "description": "n/a"}]}]}}, "dataVersion": "5.2"}

{}

{"affected": [{"affectedData": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "source": "cve@mitre.org"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A denial-of-service vulnerability exists in open5GS v2.8.0 in the PFCP transaction handling path. When the PFCP transaction or timer resource pool is exhausted, ogs_pfcp_xact_remote_create() returns NULL, but the failure is not handled properly and leads to an ogs_assert(new) failure in ogs_pfcp_xact_receive(). An attacker able to send PFCP messages to the affected SMF/UPF can exhaust transaction resources and cause the network function process to terminate with SIGABRT, resulting in service disruption and preventing further session establishment until the affected component is restarted."}], "id": "CVE-2026-106807", "lastModified": "2026-11-02T19:35:33.347", "metrics": {}, "published": "2026-11-02T17:17:33.753", "references": [{"source": "cve@mitre.org", "url": "https://gist.github.com/hackeryounow/a453020171ed5bc36036fb05c5fd448e"}, {"source": "cve@mitre.org", "url": "https://github.com/open5gs/open5gs/commit/d91af3b0ac59f6e9dab25718ef4eed9cbf2813ca"}, {"source": "cve@mitre.org", "url": "https://github.com/open5gs/open5gs/issues/4791"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Deferred"}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "2.8.0"}}], "enrichment": {"confidence": 75.0, "confidence_source": "inferred", "scores": [{"score": 75.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "n/a", "source": "cna", "vendor": "n/a"}, "product": "open5gs", "vendor": "open5gs"}], "created": "2026-11-02T17:30:17.271617+00:00", "title": "Denial of Service in open5GS PFCP Transaction Handling Causing SIGABRT", "updated": "2026-11-02T18:00:16.519590+00:00", "vendors": ["open5gs", "open5gs$PRODUCT$open5gs"], "weaknesses": ["CWE-400"]}