CVE-2026-107166: Open5GS 2.7.0, 2.7.1, 2.7.2, 2.7.3, 2.7.4, 2.7.5, 2.7.6, 2.7.7

Affected technology

Open5GS · 2.7.0, 2.7.1, 2.7.2, 2.7.3, 2.7.4, 2.7.5, 2.7.6, 2.7.7
Vendor not specified by the source

Description’s affected range: up to 2.7.7

Component: GTP-U Receive Path
Function: ogs_pfcp_xact_local_create
File: src/upf/gtp-path.c

Attack conditions (VulDB, CVSS 4.0): Network (remote) · No privileges required · No user interaction required

What an attacker can do

VulDB’s CVSS 4.0 assessment (base score 5.5/10) rates confidentiality and integrity impact as none; availability impact as low. The description does not specify what an attacker can achieve beyond these rated impacts.

Patch identifier: 9ffc252482d9b03ac01abcedbe95497ff4f95dd0