CVE-2026-108103
- Source
- https://cve.org/CVERecord?id=CVE-2026-108103
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-108103.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-108103
- Published
- 2026-10-09T14:08:13Z
- Modified
- 2026-10-11T07:04:31Z
- Severity
-
- 6.9 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N CVSS Calculator
- Summary
- Open5GS through 2.8.0 Heap Out-of-Bounds Read via PFCP Dropped DL Traffic Threshold IE
- Details
-
Open5GS through 2.8.0 contains a heap out-of-bounds read vulnerability in ogs_pfcp_parse_dropped_dl_traffic_threshold() that allows remote unauthenticated attackers to read past IE buffers via short IEs. Attackers can send PFCP Session Establishment or Modification Requests to the UPF on UDP port 8805 with DLPA and DLBY flags set, potentially crashing the UPF.
- Database specific
{ "cna_assigner": "VulnCheck", "cwe_ids": [ "CWE-125" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/108xxx/CVE-2026-108103.json" }- References
-
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/108xxx/CVE-2026-108103.json
- https://nvd.nist.gov/vuln/detail/CVE-2026-108103
- https://www.vulncheck.com/advisories/open5gs-through-2.8.0-heap-out-of-bounds-read-via-pfcp-dropped-dl-traffic-threshold-ie
- https://github.com/open5gs/open5gs/commit/88e64fc1f87e0d321364b3bb710ef6a8f274e568
- https://github.com/open5gs/open5gs
- https://github.com/open5gs/open5gs/blob/v2.8.0/lib/pfcp/types.c#L484-L516
Affected packages
Git / github.com/open5gs/open5gs
Affected versions
v0.*
v0.1.0
v0.1.1
v0.2.0
v0.3.0
v0.3.1
v0.3.10
v0.3.2
v0.3.3
v0.3.4
v0.3.5
v0.3.6
v0.3.8
v0.4.1
v0.4.2
v0.4.3
v0.4.4
v0.5.0
v0.5.1
v0.5.2
v1.*
v1.0.0
v1.1.0
v1.2.0
v1.2.1
v1.2.2
v1.2.3
v1.2.4
v1.3.0
v2.*
v2.0.0
v2.0.18
v2.0.22
v2.1.0
v2.1.1
v2.1.3
v2.1.4
v2.1.5
v2.1.7
v2.2.0
v2.2.1
v2.2.6
v2.2.7
v2.2.8
v2.2.9
v2.3.0
v2.3.2
v2.3.6
v2.4.0
v2.4.1
v2.4.3
v2.4.4
v2.4.5
v2.4.7
v2.4.8
v2.4.9
v2.6.1
v2.6.2
v2.6.3
v2.6.4
v2.6.6
v2.7.0
v2.7.1
v2.7.2
v2.7.7
Database specific
source
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-108103.json"
vanir_signatures
[
{
"deprecated": false,
"digest": {
"function_hash": "269989511999798805408776959487049030916",
"length": 1584
},
"id": "CVE-2026-108103-3271f6be",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/open5gs/open5gs/commit/157f611a530e292e40ec50f9d23f0ef5d4fcd6a6",
"target": {
"file": "tests/common/context.c",
"function": "test_db_insert_ue"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"24098572416494072472150174992433296179",
"102011634049678408723019554683134086501",
"334628121676193358138528584516549553354",
"274739736020382121818400731373501563568",
"210255659609178576028994543563152737364",
"337419046187823867919651963679907034869",
"335787937892458187444198325209045812314",
"250497098468205564293817259491093278762",
"51139697771188920290304325508571534461",
"127514162816864497527359258878367565293",
"52802380939896300410953767488256778486",
"191529502536841959918014990497009209665",
"286133117024428088768029061786940989281",
"151404358873934529804179734759712114508",
"285560979195363608657879136400691389807",
"306360920632982004865661843172582088135",
"9183174964650911865162357864238923380",
"91196307377419716945561335865012587841",
"123977867921715620468747127288998793384",
"286572280449947890399812458960675175348",
"147254370855749043554921551782228934106",
"173457517638031104515525655001479029737",
"254786090509838590134396590135160131677",
"47467061996431719772309775666915714413",
"89241205054160065342541941948408079734",
"327965230742814556467182577592754373849",
"158465824985596109661261223363404239674",
"170895426058734597720407471170774687572",
"67331423878907879928133923668761356268",
"144502042865972580787266081535691802737",
"289357496847012309729013772817704057247",
"193451044817949942763423008081306753429",
"8970344623089997919651057272702534298",
"21335361629920037799591448336549689138",
"273336364678120884226003284112256368183",
"163808352132000097005980715737058783445",
"225801961927315224131595807822698099834",
"166795403053640088898616201799400376173",
"23996398597399139794743613190490105800",
"200761104494362634891072566450496824339",
"33910910180840363779350429344562625913",
"171125551633909087742701989347698032986",
"224967580439477737051703460738835686301",
"294728112160571901127606283926061781348",
"300670740419949274378225274731708820411",
"248011634124845179623820673205960667136",
"263549622673136786300606728066195204208",
"323634521850669143210216036796225700585",
"272935410621454145812786262260216656078",
"252651680259454007611679593695565910113",
"210150846499217676718203620049264051794",
"115626134631479398184023481881878018360"
],
"threshold": 0.9
},
"id": "CVE-2026-108103-47ccaf8f",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/open5gs/open5gs/commit/88e64fc1f87e0d321364b3bb710ef6a8f274e568",
"target": {
"file": "lib/pfcp/types.c"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"89714231803210300349029899902762723787",
"216254685653352833187689837665217332085",
"335816294610166792862992334015549679232",
"45647755495410842334388829683427303171",
"300040392950149666439873900614186251387",
"44008193511893640358241655468743290907",
"101891682352354475027959434028209490796",
"45647755495410842334388829683427303171"
],
"threshold": 0.9
},
"id": "CVE-2026-108103-79321a86",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/open5gs/open5gs/commit/157f611a530e292e40ec50f9d23f0ef5d4fcd6a6",
"target": {
"file": "tests/common/context.c"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "315917536993569287718196560362039213274",
"length": 1932
},
"id": "CVE-2026-108103-93357c0b",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/open5gs/open5gs/commit/88e64fc1f87e0d321364b3bb710ef6a8f274e568",
"target": {
"file": "lib/pfcp/types.c",
"function": "ogs_pfcp_parse_volume_measurement"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "41450158522692814679943393910763103136",
"length": 1861
},
"id": "CVE-2026-108103-951db9de",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/open5gs/open5gs/commit/88e64fc1f87e0d321364b3bb710ef6a8f274e568",
"target": {
"file": "lib/pfcp/types.c",
"function": "ogs_pfcp_parse_volume"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "303523409238699774283300176284088704529",
"length": 3458
},
"id": "CVE-2026-108103-b6d2d72c",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/open5gs/open5gs/commit/88e64fc1f87e0d321364b3bb710ef6a8f274e568",
"target": {
"file": "lib/pfcp/types.c",
"function": "ogs_pfcp_parse_sdf_filter"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "160965703418474643946988130580321390516",
"length": 981
},
"id": "CVE-2026-108103-bafe692c",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/open5gs/open5gs/commit/88e64fc1f87e0d321364b3bb710ef6a8f274e568",
"target": {
"file": "lib/pfcp/types.c",
"function": "ogs_pfcp_parse_dropped_dl_traffic_threshold"
}
}
]
vanir_signatures_modified
"2026-10-11T07:04:31Z"