Live › vulnerability › CVE-2026-106806
Open5GS 2.8.0's HTTP/2 Service Based Interface server leaks previously allocated header strings when header names repeat. An unauthenticated remote attacker can send small HPACK-compressed requests with tens of thousands of duplicate headers, exhausting process memory and terminating the network function.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-02 18:24 UTC. All times on this page are UTC.
Operators running Open5GS 2.8.0 with the HTTP/2 Service Based Interface server reachable from a network an attacker can reach. Deployments on private, isolated core networks with no untrusted access to the SBI are lower exposure. Other Open5GS versions are not stated as affected.
No product ranges from the sources yet.
open5gs-amfd --version or the package manager, and see whether it is 2.8.0.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A memory exhaustion issue exists in Open5GS v2.8.0 in the HTTP/2 SBI server. Repeated header names cause previously allocated header strings to be leaked, and HPACK compression allows an unauthenticated remote attacker to trigger tens of thousands of duplicate headers with a small request. Repeated crafted requests can cause persistent heap growth, exhaust process memory, and terminate the affected Open5GS network function, resulting in denial of service.
This page as .md · .json · in your agent: get_signal("CVE-2026-106806")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.