CVE-2026-2521 is a medium severity memory corruption flaw (CVSS 5.3) in Open5GS up to 2.7.6, in the SGW-C component. The function sgwc_s5c_handle_create_session_response does not check a length field before using it, which can corrupt memory and crash the service. The record says the attack can be launched remotely and that an exploit has been published. No fixed version is confirmed, so check the project before relying on a release.
What's affected
- Affected: Open5GS up to and including 2.7.6, in the SGW-C.
- Fixed in: not confirmed. The record says the project was informed through an issue report and had not responded when the record was written. The GitHub issue (number 4282) now shows as closed, but the page I read does not say which release, if any, carries a fix.
The report describes the trigger as an oversized length value in a Create Session Response message, with a missing bounds check. The CVSS vector rates the impact as a low availability loss, with no confidentiality or integrity impact.
How to check if you're exposed
Find the Open5GS version you run, from your package manager or container image tag, and compare it with 2.7.6. Then check who can send GTP-C signalling to the SGW-C component. In a well built core network those interfaces are only open to your own network elements.
What to do now
- Look at the Open5GS releases and issue tracker for a fix newer than 2.7.6, and upgrade when you have confirmed it.
- Restrict signalling interfaces to trusted peers using firewalls and network segmentation.
- Monitor the SGW-C component for unexpected restarts, and set up automatic restart with alerting.
- If you run Open5GS in a lab or private network, document which peers are allowed to talk to it.
Try it yourself
Click through it at your own pace, or open it full screen.
Why it matters
The SGW-C handles the response from the PGW on the S5-C interface. A faulty or hostile peer on that interface is the path the issue describes. The class is CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer). In a mobile core, a crash in a signalling function can drop sessions for many subscribers, even when the score is only medium.
The record notes that an exploit is public. That does not make it more severe on paper, but it means you should not wait for a convenient maintenance window. It is not listed on the CISA Known Exploited Vulnerabilities catalog.
Quick check
Is there a patch for CVE-2026-2521?
I could not confirm one. The record says the project had not responded, and the issue page is closed without a release reference that I could read. Check the project's releases.
Is it exploited in the wild?
The record says a public exploit exists but does not report attacks, and the CISA catalog does not list it.
Sources
Last reviewed: 19 October 2026.
