CVE-2026-82589 Open5GS CVE debrief

Who should care

Users of Open5GS versions earlier than 2.8.0 should assess their exposure and apply the patch. This includes operators, platform administrators, and security teams responsible for vulnerability management. The vulnerability's impact is likely limited due to the low CVSS score, but affected deployments should still be identified and remediated.

Technical summary

A denial-of-service vulnerability exists in Open5GS up to 2.7.7 in the amf_namf_comm_handle_n1_n2_message_transfer function. The vulnerability can be triggered remotely by manipulating the N1N2MessageTransferReqData.n2InfoContainer.smInfo.n2InfoContent.ngapIeType argument. The CVSS score of 2.1 indicates a low severity, but defenders should still assess their exposure and apply the patch. The patch is named abf8a836564b966b5141110fc25ed413c4f17522.

Defensive priority

Low-priority defensive review recommended due to limited attack surface and low CVSS score.

Recommended defensive actions

• Verify Open5GS version is not earlier than 2.8.0
• Assess attack surface for potential exposure
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance

Evidence notes

Evidence is limited; primary official records indicate a denial-of-service vulnerability in Open5GS up to 2.7.7. Further review required to assess actual impact and verify vendor remediation. The attack surface appears limited based on the CVSS score of 2.1, but defenders should verify their exposure and review the patch for completeness. Limited source details are available, so additional verification is necessary.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.