CVE-2026-108103

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-108103
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-108103.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-108103
Published
2026-10-09T14:08:13Z
Modified
2026-10-28T11:06:11Z
Severity
  • 6.9 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N CVSS Calculator
Summary
Open5GS through 2.8.0 Heap Out-of-Bounds Read via PFCP Dropped DL Traffic Threshold IE
Details

Open5GS through 2.8.0 contains a heap out-of-bounds read vulnerability in ogs_pfcp_parse_dropped_dl_traffic_threshold() that allows remote unauthenticated attackers to read past IE buffers via short IEs. Attackers can send PFCP Session Establishment or Modification Requests to the UPF on UDP port 8805 with DLPA and DLBY flags set, potentially crashing the UPF.

Database specific 
{
    "cna_assigner":  "VulnCheck",
    "cwe_ids":  [
        "CWE-125"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/108xxx/CVE-2026-108103.json"
}
References

Affected packages

Git / github.com/open5gs/open5gs

Affected ranges

Type
GIT
Repo
https://github.com/open5gs/open5gs
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
88e64fc1f87e0d321364b3bb710ef6a8f274e568
Database specific
Show details 
{
    "extracted_events":  [
        {
            "range":  [
                {
                    "introduced":  "0"
                },
                {
                    "last_affected":  "2.8.0"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandardRange"
        },
        {
            "range":  [
                {
                    "fixed":  "88e64fc1f87e0d321364b3bb710ef6a8f274e568"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        }
    ]
}

Affected versions

v0.*
v0.1.0
v0.1.1
v0.2.0
v0.3.0
v0.3.1
v0.3.10
v0.3.2
v0.3.3
v0.3.4
v0.3.5
v0.3.6
v0.3.8
v0.4.1
v0.4.2
v0.4.3
v0.4.4
v0.5.0
v0.5.1
v0.5.2
v1.*
v1.0.0
v1.1.0
v1.2.0
v1.2.1
v1.2.2
v1.2.3
v1.2.4
v1.3.0
v2.*
v2.0.0
v2.0.18
v2.0.22
v2.1.0
v2.1.1
v2.1.3
v2.1.4
v2.1.5
v2.1.7
v2.2.0
v2.2.1
v2.2.6
v2.2.7
v2.2.8
v2.2.9
v2.3.0
v2.3.2
v2.3.6
v2.4.0
v2.4.1
v2.4.3
v2.4.4
v2.4.5
v2.4.7
v2.4.8
v2.4.9
v2.6.1
v2.6.2
v2.6.3
v2.6.4
v2.6.6
v2.7.0
v2.7.1
v2.7.2
v2.7.7
v2.8.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-108103.json"
vanir_signatures 
[
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "24098572416494072472150174992433296179",
                "102011634049678408723019554683134086501",
                "334628121676193358138528584516549553354",
                "274739736020382121818400731373501563568",
                "210255659609178576028994543563152737364",
                "337419046187823867919651963679907034869",
                "335787937892458187444198325209045812314",
                "250497098468205564293817259491093278762",
                "51139697771188920290304325508571534461",
                "127514162816864497527359258878367565293",
                "52802380939896300410953767488256778486",
                "191529502536841959918014990497009209665",
                "286133117024428088768029061786940989281",
                "151404358873934529804179734759712114508",
                "285560979195363608657879136400691389807",
                "306360920632982004865661843172582088135",
                "9183174964650911865162357864238923380",
                "91196307377419716945561335865012587841",
                "123977867921715620468747127288998793384",
                "286572280449947890399812458960675175348",
                "147254370855749043554921551782228934106",
                "173457517638031104515525655001479029737",
                "254786090509838590134396590135160131677",
                "47467061996431719772309775666915714413",
                "89241205054160065342541941948408079734",
                "327965230742814556467182577592754373849",
                "158465824985596109661261223363404239674",
                "170895426058734597720407471170774687572",
                "67331423878907879928133923668761356268",
                "144502042865972580787266081535691802737",
                "289357496847012309729013772817704057247",
                "193451044817949942763423008081306753429",
                "8970344623089997919651057272702534298",
                "21335361629920037799591448336549689138",
                "273336364678120884226003284112256368183",
                "163808352132000097005980715737058783445",
                "225801961927315224131595807822698099834",
                "166795403053640088898616201799400376173",
                "23996398597399139794743613190490105800",
                "200761104494362634891072566450496824339",
                "33910910180840363779350429344562625913",
                "171125551633909087742701989347698032986",
                "224967580439477737051703460738835686301",
                "294728112160571901127606283926061781348",
                "300670740419949274378225274731708820411",
                "248011634124845179623820673205960667136",
                "263549622673136786300606728066195204208",
                "323634521850669143210216036796225700585",
                "272935410621454145812786262260216656078",
                "252651680259454007611679593695565910113",
                "210150846499217676718203620049264051794",
                "115626134631479398184023481881878018360"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-108103-47ccaf8f",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/open5gs/open5gs/commit/88e64fc1f87e0d321364b3bb710ef6a8f274e568",
        "target":  {
            "file":  "lib/pfcp/types.c"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "315917536993569287718196560362039213274",
            "length":  1932
        },
        "id":  "CVE-2026-108103-93357c0b",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/open5gs/open5gs/commit/88e64fc1f87e0d321364b3bb710ef6a8f274e568",
        "target":  {
            "file":  "lib/pfcp/types.c",
            "function":  "ogs_pfcp_parse_volume_measurement"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "41450158522692814679943393910763103136",
            "length":  1861
        },
        "id":  "CVE-2026-108103-951db9de",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/open5gs/open5gs/commit/88e64fc1f87e0d321364b3bb710ef6a8f274e568",
        "target":  {
            "file":  "lib/pfcp/types.c",
            "function":  "ogs_pfcp_parse_volume"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "303523409238699774283300176284088704529",
            "length":  3458
        },
        "id":  "CVE-2026-108103-b6d2d72c",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/open5gs/open5gs/commit/88e64fc1f87e0d321364b3bb710ef6a8f274e568",
        "target":  {
            "file":  "lib/pfcp/types.c",
            "function":  "ogs_pfcp_parse_sdf_filter"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "160965703418474643946988130580321390516",
            "length":  981
        },
        "id":  "CVE-2026-108103-bafe692c",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/open5gs/open5gs/commit/88e64fc1f87e0d321364b3bb710ef6a8f274e568",
        "target":  {
            "file":  "lib/pfcp/types.c",
            "function":  "ogs_pfcp_parse_dropped_dl_traffic_threshold"
        }
    }
]
vanir_signatures_modified 
"2026-10-28T11:06:11Z"