Open5GS MME: Denial of service via reachable assertion in GTPv1 SGSN Context Request

Summary

Open5GS through version 2.8.0 contains a reachable assertion in the MME function mme_gn_handle_sgsn_context_request(). A remote attacker who sends GTPv1-C traffic from a configured SGSN address and knows a subscriber's IMSI or P-TMSI can supply an invalid address length and crash the open5gs-mmed process. This denies service to all subscribers served by that MME. The attacker needs no credentials, but the required SGSN peer address and subscriber identifier limit practical exposure.

Affected

• Open5GS through 2.8.0 (per CVE record and vendor advisory GHSA-9crh-64c8-56q6)

Fixed in

• Unknown. Fix commits: 346ce7a5e5cf2812bac3af042b5afba35bcf4f89 and 157f611a530e292e40ec50f9d23f0ef5d4fcd6a6. The first fixed release has not been confirmed; check the GitHub advisory and releases page.

Workaround

• No vendor workaround found.
• Until patched: restrict GTPv1-C (Gn) traffic to known SGSN peers at the network edge.
• Keep the MME off untrusted network segments.

Exploitation

• No evidence of exploitation in the wild. Not listed in CISA KEV.
• CISA SSVC: exploitation status 'poc', automatable: no, technical impact: partial.
• No confirmed public exploit found.

Our recommendation

• If you run Open5GS, check whether the version is 2.8.0 or earlier and whether the Gn interface is enabled.
• Restrict Gn/GTPv1-C traffic to known SGSN peers and keep the MME off untrusted networks.
• Plan an upgrade to the fixed release once confirmed in the GitHub advisory.
• If you do not run Open5GS, no action is needed.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• GitHub Security Advisory GHSA-9crh-64c8-56q6 github.com
• VulnCheck advisory www.vulncheck.com
• Fix commit 346ce7a5 github.com
• Vulnerable code mme-gn-handler.c v2.8.0 github.com
• Open5GS project repository github.com
• OSV CVE-2026-108105 osv.dev
• Open5GS releases github.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 16:46.