{"id":"CVE-2026-106806","kind":"vulnerability","aliases":["CVE-2026-106806"],"related":[],"title":"Open5GS: repeated HTTP/2 headers leak memory and crash the network function","description":"A memory exhaustion issue exists in Open5GS v2.8.0 in the HTTP/2 SBI server. Repeated header names cause previously allocated header strings to be leaked, and HPACK compression allows an unauthenticated remote attacker to trigger tens of thousands of duplicate headers with a small request. Repeated crafted requests can cause persistent heap growth, exhaust process memory, and terminate the affected Open5GS network function, resulting in denial of service.","summary":"Open5GS 2.8.0's HTTP/2 Service Based Interface server leaks previously allocated header strings when header names repeat. An unauthenticated remote attacker can send small HPACK-compressed requests with tens of thousands of duplicate headers, exhausting process memory and terminating the network function.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["5g-core","http2","open5gs","runtime","telecom"],"not_affected_if":["default-config"],"how_to_check":"- Check the installed Open5GS version, for example with `open5gs-amfd --version` or the package manager, and see whether it is `2.8.0`.\n- Confirm the SBI HTTP/2 server is reachable from untrusted networks.","fix":"- Open5GS: the sources point to a patch on GitHub; the fixed version is unknown.","status":"open","published_at":"2026-11-02T18:18:33+00:00","first_seen_at":"2026-11-02T18:24:24+00:00","triaged_at":"2026-11-02T18:24:44+00:00","updated_at":"2026-11-02T18:24:45+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-11-02T18:24:44Z","model":"claude-haiku-5-5","output":{"fix":"- Open5GS: the sources point to a patch on GitHub; the fixed version is unknown.","reach":"network","title":"Open5GS: repeated HTTP/2 headers leak memory and crash the network function","impact":"low","summary":"Open5GS 2.8.0's HTTP/2 Service Based Interface server leaks previously allocated header strings when header names repeat. An unauthenticated remote attacker can send small HPACK-compressed requests with tens of thousands of duplicate headers, exhausting process memory and terminating the network function.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["open5gs","5g-core","telecom","http2"],"confidence":0.6,"fix_status":"available","needs_auth":"no","worst_case":"Network function crashes; repeated requests cause denial of service","analyst_note":"Confirm the fixed Open5GS version from the linked GitHub patch and whether the SBI server is exposed by default.","how_to_check":"- Check the installed Open5GS version, for example with `open5gs-amfd --version` or the package manager, and see whether it is `2.8.0`.\n- Confirm the SBI HTTP/2 server is reachable from untrusted networks.","plain_action":"","needs_analyst":true,"not_affected_if":["default-config"],"who_is_affected":"Operators running Open5GS 2.8.0 with the HTTP/2 Service Based Interface server reachable from a network an attacker can reach. Deployments on private, isolated core networks with no untrusted access to the SBI are lower exposure. Other Open5GS versions are not stated as affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000714,"input_tokens":4184,"output_tokens":592,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-106806':14A,17A '-2026':13A,16A '2.8.0':26B '5g':19B '5g-core':18B 'affect':126C 'alloc':35B,86C 'allow':95C 'attack':45B,99C 'base':30B 'caus':84C,116C 'compress':51B,94C 'core':20B 'craft':113C 'crash':8A 'cve':12A,15A 'denial':132C 'duplic':58B,106C 'exhaust':60B,70C,120C 'exist':72C 'function':11A,67B,129C 'growth':119C 'header':4A,36B,39B,59B,82C,87C,107C 'heap':118C 'hpack':50B,93C 'hpack-compress':49B 'http/2':3A,28B,78C 'http2':21B 'interfac':31B 'issu':71C 'leak':5A,33B,91C 'memori':6A,62B,69C,122C 'name':40B,83C 'network':10A,66B,128C 'open5gs':1A,22B,25B,74C,127C 'persist':117C 'previous':34B,85C 'process':61B,121C 'remot':44B,98C 'repeat':2A,41B,81C,112C 'request':52B,111C,114C 'result':130C 'runtim':23B 'sbi':79C 'send':47B 'server':32B,80C 'servic':29B,134C 'small':48B,110C 'string':37B,88C 'telecom':24B 'ten':54B,102C 'termin':64B,124C 'thousand':56B,104C 'trigger':101C 'unauthent':43B,97C 'v2.8.0':75C","nicknames":[],"mitigations":[],"who_affected":"Operators running Open5GS 2.8.0 with the HTTP/2 Service Based Interface server reachable from a network an attacker can reach. Deployments on private, isolated core networks with no untrusted access to the SBI are lower exposure. Other Open5GS versions are not stated as affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["5gcore","high","http2","open5gs","runtime","telecom"],"first_public_at":"2026-11-02T18:18:33+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-106806","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-106806","severity":null,"published_at":"2026-11-02T18:18:33+00:00","modified_at":"2026-11-02T18:18:33+00:00","first_seen_at":"2026-11-02T18:24:24+00:00","fetched_at":"2026-11-02T18:24:24+00:00","note":null}],"documents":[{"id":53246,"url":"https://github.com/open5gs/open5gs/commit/76f15375ead1b2db09193458e56640da0a86c255","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}