CVE-2026-2522 is a medium severity memory corruption flaw (CVSS 5.3) in Open5GS up to 2.7.6, in the MME component. The record points to /src/mme/esm-build.c, where an oversized length in the response can crash the service. The record says the attack can be launched remotely and that an exploit has been published. No fixed version is confirmed, so check the project before relying on a release.
What's affected
- Affected: Open5GS up to and including 2.7.6, in the MME.
- Fixed in: not confirmed. The record says the project was informed through an issue report and had not responded when the record was written. The GitHub issue (number 4283) now shows as closed, but the page I read does not say which release, if any, carries a fix.
The report describes the trigger as an oversized length value in a Create Session Response message, with a missing bounds check. The CVSS vector rates the impact as a low availability loss, with no confidentiality or integrity impact.
How to check if you're exposed
Find the Open5GS version you run, from your package manager or container image tag, and compare it with 2.7.6. Then check who can send GTP-C signalling to the MME component. In a well built core network those interfaces are only open to your own network elements.
What to do now
- Look at the Open5GS releases and issue tracker for a fix newer than 2.7.6, and upgrade when you have confirmed it.
- Restrict signalling interfaces to trusted peers using firewalls and network segmentation.
- Monitor the MME component for unexpected restarts, and set up automatic restart with alerting.
- If you run Open5GS in a lab or private network, document which peers are allowed to talk to it.
Why it matters
The MME receives the Create Session Response on the S11 interface. The issue title describes a remote denial of service from an oversized length value. The class is CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer). In a mobile core, a crash in a signalling function can drop sessions for many subscribers, even when the score is only medium.
The record notes that an exploit is public. That does not make it more severe on paper, but it means you should not wait for a convenient maintenance window. It is not listed on the CISA Known Exploited Vulnerabilities catalog.
Quick check
Is there a patch for CVE-2026-2522?
I could not confirm one. The record says the project had not responded, and the issue page is closed without a release reference that I could read. Check the project's releases.
Is it exploited in the wild?
The record says a public exploit exists but does not report attacks, and the CISA catalog does not list it.
Sources
Last reviewed: 19 October 2026.
