CVE-2026-108102

Name of the Vulnerable Software and Affected Versions Open5GS versions prior to 2.8.1

Description A heap out-of-bounds read occurs in the ogs pfcp parse volume measurement() function within lib/pfcp/types.c. Remote unauthenticated attackers can exploit this by sending a PFCP Session Report Request to the Session Management Function (SMF) on UDP port 8805. By using a short Volume Measurement Information Element (IE) with all flags set, an attacker can read up to 48 bytes beyond the IE buffers, which may lead to a crash of the SMF.

Recommendations Update to version 2.8.1 or later.