CVE-2026-108105
Open5GS through 2.8.0 contains a reachable assertion vulnerability in mme_gn_handle_sgsn_context_request() that allows remote unauthenticate
CVSS
5.9
Medium
EPSS
0.5%
p44
KEV
—
Exploit Today
13
0-100
Published: Oct 9, 2026 · Last modified: Oct 9, 2026 · CWE-617
0.5%EPSS · 30 days0.5%
2026-10-102026-10-23
Open5GS through 2.8.0 contains a reachable assertion vulnerability in mme_gn_handle_sgsn_context_request() that allows remote unauthenticated attackers to crash the MME via malformed SGSN Address IEs. Attackers sending GTPv1-C traffic from a configured SGSN address with a known UE IMSI or P-TMSI can supply an invalid address length to terminate open5gs-mmed, denying service to all subscribers.
- github.comhttps://github.com/open5gs/open5gs
- github.comhttps://github.com/open5gs/open5gs/blob/v2.8.0/src/mme/mme-gn-handler.c#L208-L217
- github.comhttps://github.com/open5gs/open5gs/commit/346ce7a5e5cf2812bac3af042b5afba35bcf4f89
- github.comhttps://github.com/open5gs/open5gs/security/advisories/GHSA-9crh-64c8-56q6
- www.vulncheck.comhttps://www.vulncheck.com/advisories/open5gs-through-2.8.0-mme-reachable-assertion-via-gtpv1-sgsn-context-request
- github.comhttps://github.com/open5gs/open5gs/security/advisories/GHSA-9crh-64c8-56q6
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-764917.5 HIG17.2%
——5As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Expressway Series software engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that address multiple internally discovered vulnerabilities.
The vulnerabilities tracked by CVE-2026-76491 are related to issues concerning reachable assertions that are grouped under the Common Weakness Enumeration (CWE) Base CWE-617.1dCVE-2026-1024837.5 HIG47.1%
——14Reachable exit in NTPsec ntpd 1.1.4 through 1.2.5 allows a remote attacker to terminate the daemon via an NTS request with excess NTS Cookie Placeholder extension fields.2dCVE-2026-973137.5 HIG38.0%
——11A recursive BIND server that receives a query with recursion desired (RD=1) followed by a non-recursive query (RD=0) may exit with an assertion failure, resulting in a denial of service. To be vulnerable, the BIND server must allow recursive queries and have at least two RPZ zones configured: one with the default setting of "recursive-only yes", and the other with "recursive-only no".
This issue affects BIND 9 versions 9.16.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0 through 9.21.26, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.29-S1.2dCVE-2026-968887.5 HIG39.0%
——12A BIND resolver that is configured with both a "redirect" zone and "qname-minimization strict" may abort with an assertion failure while processing the redirect.
This issue affects BIND 9 versions 9.16.0 through 9.18.50, 9.20.0 through 9.20.29, 9.21.0 through 9.21.26, 9.16.8-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.29-S1.2dCVE-2026-98253.7 LOW18.1%
——5IBM Cyber Fraud 1.0.0 through 1.0.2 has a missing secure attribute allowing sensitive cookies to be transmitted over unencrypted connections, potentially enabling an attacker to intercept session data through network-based attacks.2dCVE-2026-43853—35.8%
——11A vulnerability could allow an attacker to send a crafted message to trigger an assertion fault, causing the service to crash.3d