CVE-2026-116543GHSA-25v2-v588-jq8g
Open5GS 1.3.0 through 2.8.0 Heap Out-of-Bounds Write via SBI Multipart Parser
open5gs open5gs
CVSS
8.7HighExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
Fixed inNone listedNo source names a fixed version. Check the vendor advisory below
What fixes it
No source in this snapshot names a fixed version. The vendor advisories under References are the place to check.
Description
Open5GS 1.3.0 through 2.8.0 contains a heap out-of-bounds write vulnerability in parse_multipart() that allows unauthenticated attackers to corrupt memory by supplying an empty multipart boundary. Attackers can send a single crafted multipart/related request to the SBI interface of any network function, overflowing the lookbehind buffer and crashing it.
Text from CVE List
Affected versions 1
- open5gsaffected: 1.3.0 through 2.8.0CVE List
References 6
- github.com/open5gs/open5gs/commit/6820c2743b5b5e126e3755d2f92dae2b236732dfFixvia CVE List
- github.com/open5gs/open5gs/security/advisories/GHSA-25v2-v588-jq8gAdvisoryvia CVE List
- vulncheck.com/advisories/open5gs-1.3.0-through-2.8.0-heap-out-of-bounds-write-via-sbi-multipart-parserAdvisoryvia CVE List
- github.com/open5gs/open5gs/blob/v2.8.0/lib/sbi/message.c#L3372Referencevia CVE List
- github.com/open5gs/open5gs/blob/v2.8.0/lib/sbi/contrib/multipart_parser.c#L260Referencevia CVE List
- github.com/open5gs/open5gsReferencevia CVE List