{"id":"CVE-2025-15418","title":"A security flaw has been discovered in Open5GS up to 2.7.6","summary":"A security flaw has been discovered in Open5GS up to 2.7.6. Affected by this vulnerability is the function ogs_gtp2_parse_bearer_qos in the library lib/gtp/v2/types.c of the component Bearer QoS IE Length Handler. Performing a manipulati…","severity":"low","cvss":3.3,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","cwe":["CWE-404"],"vendor":"open5gs","product":"open5gs","affected":["open5gs <= 2.7.6"],"published":"2026-01-02","updated":"2026-10-14","sourceUpdated":"2026-10-14T19:10:00.297","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-15418","references":[{"url":"https://github.com/open5gs/open5gs/","label":"cna@vuldb.com"},{"url":"https://github.com/open5gs/open5gs/commit/4e913d21f2c032b187815f063dbab5ebe65fe83a","label":"cna@vuldb.com"},{"url":"https://github.com/open5gs/open5gs/issues/4217","label":"cna@vuldb.com"},{"url":"https://github.com/open5gs/open5gs/issues/4217#issue-3759615968","label":"cna@vuldb.com"},{"url":"https://github.com/open5gs/open5gs/issues/4217#issuecomment-3690767105","label":"cna@vuldb.com"},{"url":"https://vuldb.com/?ctiid.339340","label":"cna@vuldb.com"},{"url":"https://vuldb.com/?id.339340","label":"cna@vuldb.com"},{"url":"https://vuldb.com/?submit.728043","label":"cna@vuldb.com"},{"url":"https://github.com/open5gs/open5gs/issues/4217","label":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"url":"https://github.com/open5gs/open5gs/issues/4217#issue-3759615968","label":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"url":"https://github.com/open5gs/open5gs/issues/4217#issuecomment-3690767105","label":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"tags":["nvd"],"epss":0.00194,"epssPercentile":0.08471,"ingestedAt":"2026-10-14T19:49:57.539Z","slug":"CVE-2025-15418","body":"## Overview\n\nA security flaw has been discovered in Open5GS up to 2.7.6. Affected by this vulnerability is the function ogs_gtp2_parse_bearer_qos in the library lib/gtp/v2/types.c of the component Bearer QoS IE Length Handler. Performing a manipulation results in denial of service. The attack must be initiated from a local position. The exploit has been released to the public and may be used for attacks. The patch is named 4e913d21f2c032b187815f063dbab5ebe65fe83a. To fix this issue, it is recommended to deploy a patch.\n\n## Affected\n\n- `open5gs <= 2.7.6`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":18,"depthScoreParts":{"impact":18.2,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}