CVE-2026-108105 — Open5GS through 2.8.0 MME Reachable Assertion via GTPv1 SGSN Context Request
Open5GS through 2.8.0 contains a reachable assertion vulnerability in mme_gn_handle_sgsn_context_request() that allows remote unauthenticated attackers to crash the MME via malf…
Published: 2026-10-09 · CVSS: 8.2 · CVSS 4.0
Open5GS through 2.8.0 contains a reachable assertion vulnerability in mme_gn_handle_sgsn_context_request() that allows remote unauthenticated attackers to crash the MME via malformed SGSN Address IEs. Attackers sending GTPv1-C traffic from a configured SGSN address with a known UE IMSI or P-TMSI can supply an invalid address length to terminate open5gs-mmed, denying service to all subscribers.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7