Open5GS: Heap out-of-bounds write in SBI multipart parser

Summary

Open5GS versions 1.3.0 through 2.8.0 contain a heap out-of-bounds write in the parse_multipart() function of the SBI (Service-Based Interface) multipart parser. An unauthenticated remote attacker can send a single crafted multipart/related request with an empty boundary to the SBI interface of a network function, corrupting memory and crashing it. The vendor advisory describes the impact as denial of service only; code execution is not demonstrated or claimed.

Affected

• Open5GS 1.3.0 through 2.8.0
• Default configuration is unaffected according to the CVE record; exposure depends on SBI reachability.

Fixed in

Unknown. No patched release number has been confirmed. The vendor advisory GHSA-25v2-v588-jq8g references commit 6820c2743b5b5e126e3755d2f92dae2b236732df; verify that the commit is included in a release before relying on it.

Workaround

• Restrict access to the SBI interface to the internal network functions that need it, using firewall rules or network segmentation.
• Keep SBI listeners off untrusted networks.
• Local patching of the boundary check is possible per the advisory's remediation, but should only be done by an experienced developer and tested.

Exploitation

• Not listed in CISA KEV; no known exploitation reported by OffSeq.
• No public exploit code found in Metasploit or Exploit-DB.
• The vendor advisory describes a reproduction causing denial of service; no independent public PoC confirmed.

Our recommendation

• Inventory any Open5GS instances in the 1.3.0 to 2.8.0 range.
• Verify that SBI interfaces are not reachable from untrusted networks.
• Restrict SBI access to required network functions and monitor for crashes or restarts.
• Upgrade to a release containing commit 6820c2743b5b5e126e3755d2f92dae2b236732df once confirmed.
• Priority is low for organisations that do not operate Open5GS, and high for operators with SBI exposed to untrusted segments.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• GitHub Security Advisory GHSA-25v2-v588-jq8g github.com
• VulnCheck Advisory www.vulncheck.com
• Fix commit 6820c27 github.com
• VulDB entry 426503 vuldb.com
• OpenCVE CVE-2026-116543 app.opencve.io
• OffSeq Radar CVE-2026-116543 radar.offseq.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 00:07.