Live › vulnerability › CVE-2026-116543
Go to dashboardOpen5GS 1.3.0 through 2.8.0 has a heap out-of-bounds write in parse_multipart() triggered by an empty multipart boundary. An unauthenticated attacker can send one crafted multipart/related request to the SBI interface of a network function, corrupting memory and crashing it.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-26 16:31 UTC. All times on this page are UTC.
Operators running Open5GS versions 1.3.0 through 2.8.0 with the SBI interface reachable by untrusted hosts. The sources describe crashes of network functions via the SBI interface; whether the write leads to code execution is not stated. Teams not running Open5GS in this range can skip it.
No product ranges from the sources yet.
1.3.0 through 2.8.02.8.0, version number unknown from sourcesEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Open5GS 1.3.0 through 2.8.0 contains a heap out-of-bounds write vulnerability in parse_multipart() that allows unauthenticated attackers to corrupt memory by supplying an empty multipart boundary. Attackers can send a single crafted multipart/related request to the SBI interface of any network function, overflowing the lookbehind buffer and crashing it.
This page as .md · .json · in your agent: get_signal("CVE-2026-116543")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.