CVE-2025-15418

Low

Description

A security flaw has been discovered in Open5GS up to 2.7.6. Affected by this vulnerability is the function ogs_gtp2_parse_bearer_qos in the library lib/gtp/v2/types.c of the component Bearer QoS IE Length Handler. Performing a manipulation results in denial of service. The attack must be initiated from a local position. The exploit has been released to the public and may be used for attacks. The patch is named 4e913d21f2c032b187815f063dbab5ebe65fe83a. To fix this issue, it is recommended to deploy a patch.

SeverityLow

CVSS3.3

Exploit probability—

ProductOpen5gs

PublishedJan 2, 2026

First seenJan 2, 2026

Weakness typeCWE-404CWE-404

How to fix

Patches

github.com/open5gs/open5gs/commit/4e913d21f2c032b187815f063dbab5ebe65fe83a

Affected products

Product	Affected versions	Fixed in
open5gs open5gs	v ≤ 2.7.6	—

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.