PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-30075 OpenAirInterface CVE debrief

CVE-2026-30075 is a Buffer Overflow vulnerability in OpenAirInterface Version 2.2.0. The vulnerability occurs in processing UplinkNASTransport containing Authentication Response with an oversized NAS PDU, which can cause the AUSF component to crash, leading to Denial of Services (DoS). This vulnerability can prohibit users from further registration and verification. The vulnerability has a CVSS score of 7.5 and is classified as HIGH severity.

Vendor
OpenAirInterface
Product
oai-cn5g-ausf
CVSS
HIGH 7.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-04-08
Original CVE updated
2026-07-25
Advisory published
2026-04-08
Advisory updated
2026-07-25

Who should care

Users and administrators of OpenAirInterface Version 2.2.0 should be aware of this vulnerability and take necessary actions to mitigate the risk. This includes verifying their deployments, monitoring for suspicious activity, and applying vendor remediation when available. Security teams and vulnerability management teams should prioritize this vulnerability due to its potential impact on service availability.

Technical summary

The vulnerability is caused by a buffer overflow in the AMF component when processing UplinkNASTransport containing Authentication Response with an oversized NAS PDU. The response is decoded by AMF and passed to the AUSF component for verification. If the response is oversized (for example, 100 bytes), AUSF crashes, leading to Denial of Services (DoS). This can prohibit users from further registration and verification. The vulnerability affects OpenAirInterface Version 2.2.0.

Defensive priority

High

Recommended defensive actions

  • Inventory and verify OpenAirInterface Version 2.2.0 installations
  • Implement compensating controls to detect and prevent oversized NAS PDU
  • Monitor for suspicious UplinkNASTransport activity
  • Apply vendor remediation when available
  • Review and update incident response plans to address potential Denial of Services
  • Conduct a thorough risk assessment to identify potential exposure
  • Verify and document the existence of affected systems in managed environments

Evidence notes

The CVE record was published on 2026-04-08T17:21:18.503Z and was last modified on 2026-07-25T10:10:00.167Z. The NVD entry is currently Analyzed. This information is based on the NVD entry and the CVE record. The vulnerability affects OpenAirInterface Version 2.2.0 and may impact other versions. Users should verify their deployments and monitor for suspicious activity.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-30075 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-30075

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-30075 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-30075

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.