CVE-2026-107166

Description

A weakness has been identified in Open5GS up to 2.7.7. This vulnerability affects the function ogs_pfcp_xact_local_create of the file src/upf/gtp-path.c of the component GTP-U Receive Path. This manipulation causes allocation of resources. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks. Patch name: 9ffc252482d9b03ac01abcedbe95497ff4f95dd0. It is recommended to apply a patch to fix this issue.

References

https://vuldb.com/vuln/414968/cti

https://vuldb.com/vuln/414968

https://vuldb.com/submit/994175

https://vuldb.com/cve/CVE-2026-107166

https://github.com/open5gs/open5gs/pull/4806

https://github.com/open5gs/open5gs/issues/4792

https://github.com/open5gs/open5gs/commit/9ffc252482d9b03ac01abcedbe95497ff4f95dd0

https://github.com/open5gs/open5gs/

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-94412

Details

Source: Mitre, NVD

Risk Information

CVSS v2

CVSS v3

CVSS v4

EPSS