CVE-2026-106807

    Dashboard / Vulnerabilities / CVE-2026-106807

    CVE-2026-106807

    Published: 2 Nov 2026Last Modified: 4 Nov 2026

    Summary:

    Details: A denial-of-service vulnerability exists in open5GS v2.8.0 in the PFCP transaction handling path. When the PFCP transaction or timer resource pool is exhausted, ogs_pfcp_xact_remote_create() returns NULL, but the failure is not handled properly and leads to an ogs_assert(new) failure in ogs_pfcp_xact_receive(). An attacker able to send PFCP messages to the affected SMF/UPF can exhaust transaction resources and cause the network function process to terminate with SIGABRT, resulting in service disruption and preventing further session establishment until the affected component is restarted.

    References: https://gist.github.com/hackeryounow/a453020171ed5bc36036fb05c5fd448e, https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/106xxx/CVE-2026-106807.json, https://nvd.nist.gov/vuln/detail/CVE-2026-106807, https://github.com/open5gs/open5gs/issues/4791, https://github.com/open5gs/open5gs/commit/d91af3b0ac59f6e9dab25718ef4eed9cbf2813ca

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -d91af3b0ac59f6e9dab25718ef4eed9cbf2813ca

    Affected versions

    v2.8.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2026-106807 | CVE-DB