Here’s your Medium article on CVE-2026–10113

CVE-2026–10113: Denial of Service Flaw Hits Open5GS’s 5G Core Parser

A publicly disclosed denial-of-service vulnerability in Open5GS, the widely used open-source 5G core and EPC implementation, lets a low-privileged remote attacker crash critical network functions by exploiting a resource-handling bug in its NF-profile parser.[sentinelone]

What Is Open5GS

Open5GS is an open-source implementation of the 5G Core and Evolved Packet Core, used by researchers, labs, and operators to build and test mobile network infrastructure. Within this architecture, the Network Repository Function (NRF) maintains profiles of all available Network Functions, and other components query it over the Service-Based Interface (SBI) using HTTP/2 with JSON payloads.[sentinelone]

The Vulnerability Explained

The flaw resides in the Shared NF-Profile Parser, specifically inside the lib/sbi/nnrf-handler.c library that decodes NF profile structures for consumption by other network functions. When this parser processes a crafted or malformed NF profile, it fails to correctly manage and release resources tied to that profile, a defect classified under CWE-404, Improper Resource Shutdown or Release.[incibe]

This resource-handling deficiency lets attacker-influenced input drive the parser into a state that destabilizes or crashes the consuming network function process entirely. Since the NRF sits at the heart of service discovery in a 5G core, disrupting it can cascade into broader availability problems across the network.[app.opencve]

Severity and Scoring

Severity assessments diverge notably across frameworks, largely because CVSS v4.0 weighs the low privilege requirement differently than v3.1 does, but all agree this sits in the low-to-medium range rather than critical.[incibe]

AttributeDetailAffected softwareOpen5GS versions up to and including 2.7.7 [sentinelone]Vulnerable componentShared NF-Profile Parser (lib/sbi/nnrf-handler.c) [sentinelone]Vulnerability typeDenial of service (CWE-404) [incibe]CVSS v4.0 score2.1 (Low) [incibe]CVSS v3.1 score4.3 (Medium) [incibe]Privileges requiredLow [sentinelone]User interactionNone [incibe]Attack vectorNetwork, via the SBI [sentinelone]Patch statusFixed in Open5GS Pull Request #4527 [sentinelone]PublishedMay 30, 2026 [incibe]

How an Attacker Exploits It

Exploitation requires network access to the SBI along with low privileges, but notably no user interaction. An attacker with valid access to the SBI submits a malformed or specially crafted NF profile representation; the Shared NF-Profile Parser ingests it, triggers the resource-handling defect, and the affected network function terminates or becomes unresponsive.[sentinelone]

Because this attack can be repeated at will, an attacker could sustain the outage by continuously sending crafted requests to the NRF service until it exhausts resources or crashes outright. Given that the NRF underpins service discovery for functions like AMF, SMF, AUSF, and UDM, a successful attack risks broader disruption of 5G core operations rather than a single isolated failure.[app.opencve]

Detection and Warning Signs

Operators running Open5GS deployments should watch their infrastructure for the following indicators of active exploitation attempts.

• Unexpected crashes or restarts of Open5GS network functions such as AMF, SMF, AUSF, or UDM that consume NRF profiles[sentinelone]
• Error log entries originating from lib/sbi/nnrf-handler.c referencing profile parsing failures[sentinelone]
• Sudden loss of NF registration state or service discovery anomalies on the NRF[sentinelone]
• Repeated malformed profile submissions targeting the SBI interface from a single source[app.opencve]

Remediation Guidance

The Open5GS maintainers have already addressed the root cause, making patching the clearest path forward for affected operators.

• Apply the upstream fix from Open5GS Pull Request #4527 and upgrade to a version beyond 2.7.7 once released.[dbugs.ptsecurity]
• Rebuild from a patched commit if an official release isn’t yet available for your deployment.[sentinelone]
• Restrict SBI interface exposure to trusted internal network segments rather than broader external access.[app.opencve]
• Monitor NF process health continuously to detect crashes early and correlate them with suspicious profile submissions.[sentinelone]

Why This Matters

Denial-of-service flaws in core 5G infrastructure carry outsized real-world consequences, since a crash in a component as central as the NRF can ripple outward and disrupt mobile connectivity for end users relying on the affected network. With a public exploit already circulating and a low bar for exploitation, operators running vulnerable Open5GS deployments should prioritize patching over deprioritizing this as merely a low-severity finding.[incibe]