{"id":"CVE-2026-108105","summary":"Open5GS through 2.8.0 MME Reachable Assertion via GTPv1 SGSN Context Request","details":"Open5GS through 2.8.0 contains a reachable assertion vulnerability in mme_gn_handle_sgsn_context_request() that allows remote unauthenticated attackers to crash the MME via malformed SGSN Address IEs. Attackers sending GTPv1-C traffic from a configured SGSN address with a known UE IMSI or P-TMSI can supply an invalid address length to terminate open5gs-mmed, denying service to all subscribers.","aliases":["GHSA-9crh-64c8-56q6"],"modified":"2026-10-11T07:04:28.510573864Z","published":"2026-10-09T14:08:16.163Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/108xxx/CVE-2026-108105.json","cna_assigner":"VulnCheck","cwe_ids":["CWE-617"]},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/108xxx/CVE-2026-108105.json"},{"type":"ADVISORY","url":"https://github.com/open5gs/open5gs/security/advisories/GHSA-9crh-64c8-56q6"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108105"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/open5gs-through-2.8.0-mme-reachable-assertion-via-gtpv1-sgsn-context-request"},{"type":"FIX","url":"https://github.com/open5gs/open5gs/commit/346ce7a5e5cf2812bac3af042b5afba35bcf4f89"},{"type":"PACKAGE","url":"https://github.com/open5gs/open5gs"},{"type":"ARTICLE","url":"https://github.com/open5gs/open5gs/blob/v2.8.0/src/mme/mme-gn-handler.c#L208-L217"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/open5gs/open5gs","events":[{"introduced":"0"},{"fixed":"157f611a530e292e40ec50f9d23f0ef5d4fcd6a6"},{"fixed":"346ce7a5e5cf2812bac3af042b5afba35bcf4f89"}],"database_specific":{"extracted_events":[{"introduced":"Open5GS"},{"fixed":"2.8.0"}],"source":["DESCRIPTION","REFERENCES"]}}],"versions":["v2.7.7","v2.7.2","v2.7.1","v2.7.0","v2.6.6","v2.6.4","v2.6.3","v2.6.2","v2.6.1","v2.4.9","v2.4.8","v2.4.7","v2.4.5","v2.4.4","v2.4.3","v2.4.1","v2.4.0","v2.3.6","v2.3.2","v2.3.0","v2.2.9","v2.2.8","v2.2.7","v2.2.6","v2.2.1","v2.2.0","v2.1.7","v2.1.5","v2.1.4","v2.1.3","v2.1.1","v2.1.0","v2.0.22","v2.0.18","v2.0.0","v1.3.0","v1.2.4","v1.2.3","v1.2.2","v1.2.1","v1.2.0","v1.1.0","v1.0.0","v0.5.2","v0.5.1","v0.5.0","v0.4.4","v0.4.3","v0.4.2","v0.4.1","v0.3.10","v0.3.8","v0.3.6","v0.3.5","v0.3.4","v0.3.3","v0.3.2","v0.3.1","v0.3.0","v0.2.0","v0.1.1","v0.1.0"],"database_specific":{"vanir_signatures_modified":"2026-10-11T07:04:28Z","source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-108105.json","vanir_signatures":[{"source":"https://github.com/open5gs/open5gs/commit/346ce7a5e5cf2812bac3af042b5afba35bcf4f89","target":{"file":"src/mme/mme-gn-handler.c"},"deprecated":false,"digest":{"line_hashes":["132434559988136792321826774643802355647","318901519032063476923171689512774126660","170649140964946700310791248365487161196","115477005847560213550587578429710094451","254680554164651195638537520010896269236","290097902580926062602556814267897077340","205825341702764610796666465915773720050","297920474589793260936976370483404068353","12871872599175114471325648973576764181","98523217150812440480074367650626835525","11611488462140391854580954515054380184","317915426695605401418025805162075472824","135834101433770311414114490294440150866","293475009066922639638065827262900276355","28790248339984505949904822704537828242","129365231934912345487008591597481385433","4036507666400591071655380726547198392","77013826496090144350749401462614257620","285028950523436960070439860194866646066","215560632675518181813416560535348723729","187866586195742875821032404803031324054"],"threshold":0.9},"id":"CVE-2026-108105-164cd08c","signature_type":"Line","signature_version":"v1"},{"id":"CVE-2026-108105-3271f6be","signature_type":"Function","signature_version":"v1","source":"https://github.com/open5gs/open5gs/commit/157f611a530e292e40ec50f9d23f0ef5d4fcd6a6","target":{"file":"tests/common/context.c","function":"test_db_insert_ue"},"deprecated":false,"digest":{"length":1584,"function_hash":"269989511999798805408776959487049030916"}},{"target":{"file":"tests/common/context.c"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["89714231803210300349029899902762723787","216254685653352833187689837665217332085","335816294610166792862992334015549679232","45647755495410842334388829683427303171","300040392950149666439873900614186251387","44008193511893640358241655468743290907","101891682352354475027959434028209490796","45647755495410842334388829683427303171"]},"id":"CVE-2026-108105-79321a86","signature_type":"Line","signature_version":"v1","source":"https://github.com/open5gs/open5gs/commit/157f611a530e292e40ec50f9d23f0ef5d4fcd6a6"},{"source":"https://github.com/open5gs/open5gs/commit/346ce7a5e5cf2812bac3af042b5afba35bcf4f89","target":{"file":"src/mme/mme-gn-handler.c","function":"mme_gn_handle_sgsn_context_request"},"deprecated":false,"digest":{"function_hash":"123550495398206744970554998335308359941","length":4960},"id":"CVE-2026-108105-f1d55e89","signature_type":"Function","signature_version":"v1"}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"}]}