Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2025-8801: Open5GS AMF may crash from remote request

CVE-2025-8801 · published 1 year ago

Summary

The core component that handles mobile‑network signaling in Open5GS (the AMF) can be forced to stop working when specially crafted messages are sent to it. This can cause a loss of service for users connected to the network. Updating Open5GS to version 2.7.6 or later resolves the issue.

What to do

Update open5gs open5gs to version 2.7.6 or later.

Affected software

Vendor	Product	Affected versions
open5gs	open5gs	< 2.7.6 `cpe:2.3:a:open5gs:open5gs::::::::`

Original advisory text

Open5GS AMF gmm-sm.c gmm_state_exception denial of service

A vulnerability was found in Open5GS up to 2.7.5. This affects the function gmm_state_exception of the file src/amf/gmm-sm.c of the component AMF. The manipulation leads to denial of service. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 2.7.6 is able to address this issue. The identifier of the patch is f47f2bd4f7274295c5fbb19e2f806753d183d09a. It is recommended to upgrade the affected component.

References

https://github.com/ZHENGHAOHELLO/BugReport/blob/main/CVE-2025-8801 URL
https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/8xxx/CVE-2025-8801.j... Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2025-8801 Vendor Advisory
https://github.com/open5gs/open5gs/issues/3977#issuecomment-3052575886 Third Party Advisory
https://github.com/open5gs/open5gs/commit/f47f2bd4f7274295c5fbb19e2f806753d183d0... Patch
https://github.com/open5gs/open5gs/releases/tag/v2.7.6 Patch
https://github.com/user-attachments/files/21095572/nudm-sdm.zip Exploit
https://vuldb.com/?id.319329 Vendor Advisory
https://vuldb.com/?submit.626118 Vendor Advisory
https://github.com/open5gs/open5gs/issues/3977 Third Party Advisory
https://vuldb.com/?ctiid.319329 Third Party Advisory

Fix within

Internet-facing 14 days

Internal 60 days

Not known to be exploited
Can be exploited automatically
Gives an attacker partial control

Severity

7.8 High

Exploitation

<1% chance of attack within 30 days

Type

CWE-404Improper Resource Shutdown or Release

Timeline

Published10 Aug 2025

Updated4 Nov 2026

First seen12 Apr 2026

Sources

CVE-2025-8801 · OSV

CVE-2025-8801 · NVD

Track software like this

Free during beta