Vulnerability · Published Oct 9, 2026 · Assigned by VulnCheck

CVE-2026-108105Open5GS through 2.8.0 MME Reachable Assertion via GTPv1 SGSN Context Request

Medium 5.9

In plain English

A medium-severity security flaw in open5gs from open5gs. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 45% of all known vulnerabilities).

Severity (CVSS 3.1)5.9Medium

Exploit odds (30 days)0.5%top 55.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Open5GS through 2.8.0 contains a reachable assertion vulnerability in mme_gn_handle_sgsn_context_request() that allows remote unauthenticated attackers to crash the MME via malformed SGSN Address IEs. Attackers sending GTPv1-C traffic from a configured SGSN address with a known UE IMSI or P-TMSI can supply an invalid address length to terminate open5gs-mmed, denying service to all subscribers.

Affected products (as reported)

Vendor	Product	Versions
open5gs	open5gs	0 – through 2.8.0

Weakness: CWE-617 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

References

Patch Commit patch
https://github.com/open5gs/open5gs product
GitHub Security Advisory (GHSA-9crh-64c8-56q6) vendor-advisory
https://github.com/open5gs/open5gs/blob/v2.8.0/src/mme/mme-gn-handler.c#L208-L217 technical-description
VulnCheck Advisory: Open5GS through 2.8.0 MME Reachable Assertion via GTPv1 SGSN Context Request third-party-advisory