---
id: "CVE-2026-106806"
kind: "vulnerability"
aliases: ["CVE-2026-106806"]
title: "Open5GS: repeated HTTP/2 headers leak memory and crash the network function"
severity: "high"
cvss: null
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["5g-core", "http2", "open5gs", "runtime", "telecom"]
not_affected_if: ["default-config"]
published_at: "2026-11-02T18:18:33+00:00"
first_seen_at: "2026-11-02T18:24:24+00:00"
updated_at: "2026-11-02T18:24:45+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-106806", "first_seen_at": "2026-11-02T18:24:24+00:00"}]
---

# Open5GS: repeated HTTP/2 headers leak memory and crash the network function

Open5GS 2.8.0's HTTP/2 Service Based Interface server leaks previously allocated header strings when header names repeat. An unauthenticated remote attacker can send small HPACK-compressed requests with tens of thousands of duplicate headers, exhausting process memory and terminating the network function.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Open5GS version, for example with `open5gs-amfd --version` or the package manager, and see whether it is `2.8.0`.
- Confirm the SBI HTTP/2 server is reachable from untrusted networks.

## Fix

- Open5GS: the sources point to a patch on GitHub; the fixed version is unknown.

## Timeline

- 2026-11-02T18:24:24+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-106806

## Documents

- [fix] Patch: github.com https://github.com/open5gs/open5gs/commit/76f15375ead1b2db09193458e56640da0a86c255

## From the sources

A memory exhaustion issue exists in Open5GS v2.8.0 in the HTTP/2 SBI server. Repeated header names cause previously allocated header strings to be leaked, and HPACK compression allows an unauthenticated remote attacker to trigger tens of thousands of duplicate headers with a small request. Repeated crafted requests can cause persistent heap growth, exhaust process memory, and terminate the affected Open5GS network function, resulting in denial of service.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_