CVE-2025-15176

Medium

Description

A flaw has been found in Open5GS up to 2.7.5. This affects the function decode_ipv6_header/ogs_pfcp_pdr_rule_find_by_packet of the file lib/pfcp/rule-match.c of the component PFCP Session Establishment Request Handler. Executing a manipulation can lead to reachable assertion. It is possible to launch the attack remotely. The exploit has been published and may be used. This patch is called b72d8349980076e2c033c8324f07747a86eea4f8. Applying a patch is advised to resolve this issue.

SeverityMedium

CVSS5.3

Exploit probability—

ProductOpen5gs

PublishedDec 29, 2025

First seenDec 29, 2025

Weakness typeCWE-617CWE-617

How to fix

Patches

github.com/open5gs/open5gs/commit/b72d8349980076e2c033c8324f07747a86eea4f8

Affected products

Product	Affected versions	Fixed in
open5gs open5gs	v ≤ 2.7.5	—

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.