Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.5

Open5GS MME Crashes When Processing Invalid UE Context Requests

CVE-2023-37022 · published 1 year ago
Summary

Open5GS MME versions 2.6.4 and earlier may crash when receiving specific, malformed requests. This can be exploited to cause a denial-of-service attack, disrupting service. Update to version 2.6.5 or later to mitigate this risk.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
open5gs open5gs <= 2.6.4
cpe:2.3:a:open5gs:open5gs:*:*:*:*:*:*:*:*
Original advisory text
Open5GS MME versions <= 2.6.4 contain a reachable assertion in the `UE Context Release Request` packet handler. A packet containing an invalid `MME_UE_S1AP_ID` field causes Open5gs to crash; an att...
Open5GS MME versions <= 2.6.4 contain a reachable assertion in the `UE Context Release Request` packet handler. A packet containing an invalid `MME_UE_S1AP_ID` field causes Open5gs to crash; an attacker may repeatedly send such packets to cause denial of service.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker partial control
Severity
7.5 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-400Uncontrolled Resource Consumption
Timeline
Published22 Jan 2025
Updated31 Oct 2026
First seen7 Mar 2026
Sources
CVE-2023-37022 · NVD
CVE-2023-37022 · OSV
Track software like this
Free during beta