CVE-2026-30045 open5gs CVE debrief

Who should care

Organizations using open5gs v2.7.6 should prioritize verification of the /nnrf-disc/v1/nf-instances component and assess potential Denial of Service (DoS) risks. Security teams and operators must review vulnerability details and plan for compensating controls if patches are not immediately feasible. Vulnerability management and platform security teams should coordinate on exposure review and remediation planning. Monitoring and detection teams should prepare for potential suspicious activity related to crafted HTTP/2 GET requests. Asset inventory management is crucial to identify potentially affected systems. This vulnerability may impact service availability, emphasizing the need for prompt review and mitigation.

Technical summary

The /nnrf-disc/v1/nf-instances component of open5gs v2.7.6 is vulnerable to an integer overflow, which can be exploited by supplying a crafted HTTP/2 GET request to cause a Denial of Service (DoS). This vulnerability is a result of improper handling of integer values in the component. Security teams should review vulnerability details and plan for compensating controls if patches are not immediately feasible. Monitoring and detection teams should prepare for potential suspicious activity related to crafted HTTP/2 GET requests.

Defensive priority

High-priority defensive actions are required to address the integer overflow vulnerability in open5gs v2.7.6.

Recommended defensive actions

• Inventory and verify open5gs v2.7.6 installations for potential vulnerability
• Implement compensating controls to detect and prevent crafted HTTP/2 GET requests
• Monitor /nnrf-disc/v1/nf-instances component for suspicious activity
• Apply vendor remediation when available

Evidence notes

Evidence is limited; verify open5gs v2.7.6 /nnrf-disc/v1/nf-instances component for integer overflow vulnerability. Grounding from CVE Program and NVD indicates potential impact but requires further defensive verification. Defenders should review official advisories and assess exposure.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.