CVE-2026-108103 Open5GS through 2.8.0 Heap Out-of-Bounds Read via PFCP Dropped DL Traffic Threshold IE
Remote attackers can trigger a heap out-of-bounds read in Open5GS UPF via crafted PFCP requests, leading to information disclosure or service crashes.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-108103?
CVE-2026-108103 is a medium-severity memory corruption vulnerability in open5gs, published on 9 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Open5GS through 2.8.0 contains a heap out-of-bounds read vulnerability in ogs_pfcp_parse_dropped_dl_traffic_threshold() that allows remote unauthenticated attackers to read past IE buffers via short IEs. Attackers can send PFCP Session Establishment or Modification Requests to the UPF on UDP port 8805 with DLPA and DLBY flags set, potentially crashing the UPF.
Weakness: CWE-125
Which versions are affected by CVE-2026-108103?
How do I fix CVE-2026-108103?
No fix has been published for CVE-2026-108103 yet. Limit exposure of the affected software until one is available.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-108103 being exploited?
There is no known exploitation of CVE-2026-108103 in the wild and no public exploit code.
Sources
Also known as GHSA-4rxj-63ch-hjqf.