{"id":"CVE-2026-106808","kind":"vulnerability","aliases":["CVE-2026-106808"],"related":[],"title":"OpenAirInterface 5G core: oversized hex input crashes UDM via stack overflow","description":"OpenAirInterface Core Network v2.2.1 has a stack-based buffer overflow vulnerability in the OAI CN5G UDM Nudm_UEAU Generate Authentication Data endpoint. The UDM passes attacker-controlled resynchronizationInfo.rand and auts values to conv::hex_str_to_uint8(), which converts arbitrary-length hex strings into fixed-size stack buffers without validating the destination size. An unauthenticated attacker with access to the SBI interface and a valid SUPI can submit an oversized value to overwrite adjacent stack memory, corrupt the stack canary, and terminate the UDM process.","summary":"OpenAirInterface Core Network v2.2.1 has a stack buffer overflow in the UDM's Nudm_UEAU Generate Authentication Data endpoint, where attacker-supplied rand and auts hex strings are copied into fixed-size stack buffers without a size check. An attacker can overwrite stack memory, corrupt the stack canary, and terminate the UDM process.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"oai-cn5g-udm","fixed":[],"affected":"2.2.1","ecosystem":"vendor"}],"ecosystems":[],"tags":["5g-core","oai-cn5g","openairinterface","other","self-hosted","udm"],"not_affected_if":["other-versions","sbi-isolated"],"how_to_check":"- Check whether you run OpenAirInterface CN5G UDM v2.2.1 (container image tag or git tag v2.2.1 of oai-cn5g-udm).\n- Check whether the UDM SBI (Nudm_UEAU, Generate Authentication Data) is reachable from anything other than your trusted network functions. Exploitation needs SBI access and a valid SUPI.\n- Also check any other version built from the same UDM code; NVD names only v2.2.1.","fix":null,"status":"open","published_at":"2026-11-02T18:18:34+00:00","first_seen_at":"2026-11-02T18:24:24+00:00","triaged_at":"2026-11-02T18:24:39+00:00","updated_at":"2026-11-02T18:25:33+00:00","category":"other","confidence":0.5,"triage":{"at":"2026-11-02T18:24:39Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"OpenAirInterface 5G core: oversized hex input crashes UDM via stack overflow","impact":"medium","summary":"OpenAirInterface Core Network v2.2.1 has a stack buffer overflow in the UDM's Nudm_UEAU Generate Authentication Data endpoint, where attacker-supplied rand and auts hex strings are copied into fixed-size stack buffers without a size check. An attacker can overwrite stack memory, corrupt the stack canary, and terminate the UDM process.","audience":"businesses","category":"other","nicknames":[],"who_cares":["openairinterface","oai-cn5g","5g-core","udm"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"UDM process crashes, disrupting 5G core authentication service","analyst_note":"Check the NVD entry and the OpenAirInterface project for a fixed release and whether the SBI is reachable beyond trusted network functions.","how_to_check":"- Check whether the deployment runs OpenAirInterface Core Network (OAI CN5G) v2.2.1 and whether the UDM is exposed on its SBI interface.\n- Confirm the UDM Nudm_UEAU endpoint is reachable by untrusted parties.","plain_action":"","needs_analyst":true,"not_affected_if":["sbi-isolated","other-versions"],"who_is_affected":"Operators running OpenAirInterface Core Network v2.2.1 with the UDM network function reachable on the SBI interface. The attacker must hold a valid SUPI, so deployments where the SBI is isolated to trusted network functions are less exposed. unknown whether a patched version exists.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000742,"input_tokens":4256,"output_tokens":632,"severity_before":"unknown"},"analyst_status":"done","analyst_note":"Check the NVD entry and the OpenAirInterface project for a fixed release and whether the SBI is reachable beyond trusted network functions.","search":"'-106808':14A,17A '-2026':13A,16A '5g':2A,23B '5g-core':22B 'access':150C 'adjac':166C 'arbitrari':131C 'arbitrary-length':130C 'attack':55B,75B,116C,148C 'attacker-control':115C 'attacker-suppli':54B 'aut':59B,120C 'authent':50B,109C 'base':97C 'buffer':41B,69B,98C,140C 'canari':83B,172C 'check':73B 'cn5g':20A,27B,104C 'control':117C 'conv':123C 'convert':129C 'copi':63B 'core':3A,24B,35B,90C 'corrupt':80B,169C 'crash':7A 'cve':12A,15A 'data':51B,110C 'destin':144C 'endpoint':52B,111C 'fix':66B,137C 'fixed-s':65B,136C 'generat':49B,108C 'hex':5A,60B,124C,133C 'host':32B 'input':6A 'interfac':154C 'length':132C 'memori':79B,168C 'network':36B,91C 'nudm':47B,106C 'oai':19A,26B,103C 'oai-cn5g':25B 'oai-cn5g-udm':18A 'openairinterfac':1A,28B,34B,89C 'overflow':11A,42B,99C 'overs':4A,162C 'overwrit':77B,165C 'pass':114C 'process':88B,177C 'rand':57B 'resynchronizationinfo.rand':118C 'sbi':153C 'self':31B 'self-host':30B 'size':67B,72B,138C,145C 'stack':10A,40B,68B,78B,82B,96C,139C,167C,171C 'stack-bas':95C 'str':125C 'string':61B,134C 'submit':160C 'supi':158C 'suppli':56B 'termin':85B,174C 'udm':8A,21A,33B,45B,87B,105C,113C,176C 'ueau':48B,107C 'uint8':127C 'unauthent':147C 'v2.2.1':37B,92C 'valid':142C,157C 'valu':121C,163C 'via':9A 'vulner':100C 'without':70B,141C","nicknames":[],"mitigations":[],"who_affected":"Operators running OpenAirInterface Core Network v2.2.1 with the UDM network function reachable on the SBI interface. The attacker must hold a valid SUPI, so deployments where the SBI is isolated to trusted network functions are less exposed. unknown whether a patched version exists.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["oaicn5gudm"],"ptokens":["cn5g","oai","udm"],"labels":["5gcore","high","oaicn5g","openairinterface","other","selfhosted","udm"],"first_public_at":"2026-11-02T18:18:34+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-106808","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-106808","severity":null,"published_at":"2026-11-02T18:18:34+00:00","modified_at":"2026-11-02T18:18:34+00:00","first_seen_at":"2026-11-02T18:24:24+00:00","fetched_at":"2026-11-02T18:24:24+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-106808:1412","url":null,"severity":null,"published_at":"2026-11-02T18:25:33+00:00","modified_at":"2026-11-02T18:25:33+00:00","first_seen_at":"2026-11-02T18:25:33+00:00","fetched_at":"2026-11-02T18:25:33+00:00","note":"Only NVD found (page has no body text). No vendor advisory or fix located; OAI v2.2.1 tag (Apr 2026) is the affected version per NVD, no later release/patch confirmed. Nothing verified. Settle by checking github.com/openairinterface oai-cn5g-udm for a commit bounding hex_str_to_uint8 input."}],"documents":[{"id":53319,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-106808","title":"NVD CVE-2026-106808","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}