CVE-2026-108102

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-108102
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-108102.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-108102
Aliases
  • GHSA-37c3-hv4f-688p
Published
2026-10-09T14:08:09Z
Modified
2026-10-28T11:06:13Z
Severity
  • 6.9 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N CVSS Calculator
Summary
Open5GS through 2.8.0 Heap Out-of-Bounds Read via PFCP Volume Measurement IE
Details

Open5GS through 2.8.0 contains a heap out-of-bounds read vulnerability in ogs_pfcp_parse_volume_measurement() in lib/pfcp/types.c that allows remote unauthenticated attackers to read past IE buffers. Attackers can send a PFCP Session Report Request to the SMF on UDP port 8805 with a short, all-flags Volume Measurement IE, reading up to 48 bytes and potentially crashing the SMF.

Database specific 
{
    "cna_assigner":  "VulnCheck",
    "cwe_ids":  [
        "CWE-125"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/108xxx/CVE-2026-108102.json"
}
References

Affected packages

Git / github.com/open5gs/open5gs

Affected ranges

Type
GIT
Repo
https://github.com/open5gs/open5gs
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
88e64fc1f87e0d321364b3bb710ef6a8f274e568
Database specific
Show details 
{
    "extracted_events":  [
        {
            "range":  [
                {
                    "introduced":  "0"
                },
                {
                    "last_affected":  "2.8.0"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandardRange"
        },
        {
            "range":  [
                {
                    "fixed":  "88e64fc1f87e0d321364b3bb710ef6a8f274e568"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        }
    ]
}

Affected versions

v0.*
v0.1.0
v0.1.1
v0.2.0
v0.3.0
v0.3.1
v0.3.10
v0.3.2
v0.3.3
v0.3.4
v0.3.5
v0.3.6
v0.3.8
v0.4.1
v0.4.2
v0.4.3
v0.4.4
v0.5.0
v0.5.1
v0.5.2
v1.*
v1.0.0
v1.1.0
v1.2.0
v1.2.1
v1.2.2
v1.2.3
v1.2.4
v1.3.0
v2.*
v2.0.0
v2.0.18
v2.0.22
v2.1.0
v2.1.1
v2.1.3
v2.1.4
v2.1.5
v2.1.7
v2.2.0
v2.2.1
v2.2.6
v2.2.7
v2.2.8
v2.2.9
v2.3.0
v2.3.2
v2.3.6
v2.4.0
v2.4.1
v2.4.3
v2.4.4
v2.4.5
v2.4.7
v2.4.8
v2.4.9
v2.6.1
v2.6.2
v2.6.3
v2.6.4
v2.6.6
v2.7.0
v2.7.1
v2.7.2
v2.7.7
v2.8.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-108102.json"
vanir_signatures 
[
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "24098572416494072472150174992433296179",
                "102011634049678408723019554683134086501",
                "334628121676193358138528584516549553354",
                "274739736020382121818400731373501563568",
                "210255659609178576028994543563152737364",
                "337419046187823867919651963679907034869",
                "335787937892458187444198325209045812314",
                "250497098468205564293817259491093278762",
                "51139697771188920290304325508571534461",
                "127514162816864497527359258878367565293",
                "52802380939896300410953767488256778486",
                "191529502536841959918014990497009209665",
                "286133117024428088768029061786940989281",
                "151404358873934529804179734759712114508",
                "285560979195363608657879136400691389807",
                "306360920632982004865661843172582088135",
                "9183174964650911865162357864238923380",
                "91196307377419716945561335865012587841",
                "123977867921715620468747127288998793384",
                "286572280449947890399812458960675175348",
                "147254370855749043554921551782228934106",
                "173457517638031104515525655001479029737",
                "254786090509838590134396590135160131677",
                "47467061996431719772309775666915714413",
                "89241205054160065342541941948408079734",
                "327965230742814556467182577592754373849",
                "158465824985596109661261223363404239674",
                "170895426058734597720407471170774687572",
                "67331423878907879928133923668761356268",
                "144502042865972580787266081535691802737",
                "289357496847012309729013772817704057247",
                "193451044817949942763423008081306753429",
                "8970344623089997919651057272702534298",
                "21335361629920037799591448336549689138",
                "273336364678120884226003284112256368183",
                "163808352132000097005980715737058783445",
                "225801961927315224131595807822698099834",
                "166795403053640088898616201799400376173",
                "23996398597399139794743613190490105800",
                "200761104494362634891072566450496824339",
                "33910910180840363779350429344562625913",
                "171125551633909087742701989347698032986",
                "224967580439477737051703460738835686301",
                "294728112160571901127606283926061781348",
                "300670740419949274378225274731708820411",
                "248011634124845179623820673205960667136",
                "263549622673136786300606728066195204208",
                "323634521850669143210216036796225700585",
                "272935410621454145812786262260216656078",
                "252651680259454007611679593695565910113",
                "210150846499217676718203620049264051794",
                "115626134631479398184023481881878018360"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-108102-47ccaf8f",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/open5gs/open5gs/commit/88e64fc1f87e0d321364b3bb710ef6a8f274e568",
        "target":  {
            "file":  "lib/pfcp/types.c"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "315917536993569287718196560362039213274",
            "length":  1932
        },
        "id":  "CVE-2026-108102-93357c0b",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/open5gs/open5gs/commit/88e64fc1f87e0d321364b3bb710ef6a8f274e568",
        "target":  {
            "file":  "lib/pfcp/types.c",
            "function":  "ogs_pfcp_parse_volume_measurement"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "41450158522692814679943393910763103136",
            "length":  1861
        },
        "id":  "CVE-2026-108102-951db9de",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/open5gs/open5gs/commit/88e64fc1f87e0d321364b3bb710ef6a8f274e568",
        "target":  {
            "file":  "lib/pfcp/types.c",
            "function":  "ogs_pfcp_parse_volume"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "303523409238699774283300176284088704529",
            "length":  3458
        },
        "id":  "CVE-2026-108102-b6d2d72c",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/open5gs/open5gs/commit/88e64fc1f87e0d321364b3bb710ef6a8f274e568",
        "target":  {
            "file":  "lib/pfcp/types.c",
            "function":  "ogs_pfcp_parse_sdf_filter"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "160965703418474643946988130580321390516",
            "length":  981
        },
        "id":  "CVE-2026-108102-bafe692c",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/open5gs/open5gs/commit/88e64fc1f87e0d321364b3bb710ef6a8f274e568",
        "target":  {
            "file":  "lib/pfcp/types.c",
            "function":  "ogs_pfcp_parse_dropped_dl_traffic_threshold"
        }
    }
]
vanir_signatures_modified 
"2026-10-28T11:06:13Z"