CVE-2026-106807
Quick assessment
Affected
n/a n/a
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
open5GS v2.8.0 在 PFCP 事务处理路径中存在一个拒绝服务（DoS）漏洞。当 PFCP 事务或定时器资源池耗尽时， 函数会返回 NULL，但该失败未被正确处理，进而导致 函数中触发 断言失败。能够向受影响的 SMF 或 UPF 发送 PFCP 消息的攻击者，可以通过耗尽事务资源，致使网络功能进程因接收到 SIGABRT 信号而终止，从而造成服务中断，并阻止后续会话的建立，直至受影响的组件被重新启动。
Possible ATT&CK Techniques 1 AI
T1499 · Endpoint Denial of Service
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-106807
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Source: CVE Program / CVE List V5
Vulnerability Description
A denial-of-service vulnerability exists in open5GS v2.8.0 in the PFCP transaction handling path. When the PFCP transaction or timer resource pool is exhausted, ogs_pfcp_xact_remote_create() returns NULL, but the failure is not handled properly and leads to an ogs_assert(new) failure in ogs_pfcp_xact_receive(). An attacker able to send PFCP messages to the affected SMF/UPF can exhaust transaction resources and cause the network function process to terminate with SIGABRT, resulting in service disruption and preventing further session establishment until the affected component is restarted.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| - | n/a | n/a | - |
|
II. Public POCs for CVE-2026-106807
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-106807
请登录查看更多情报信息。
Other References for CVE-2026-106807 (3)
Same Patch Batch · n/a · 2026-11-02 · 11 CVEs total
| CVE-2025-62819 | Keyfactor EJBCA 9.3.3 前版本证书续期授权绕过漏洞 | |
| CVE-2026-106805 | Free5GC v4.2.3 PFCP 会话建立资源耗尽漏洞 | |
| CVE-2026-106803 | Kamailio 6.1.x ims_registrar_pcscf 栈缓冲区溢出 | |
| CVE-2026-106804 | Kamailio v6.1.x ims_qos_npn 模块栈溢出漏洞 | |
| CVE-2026-117068 | OpenAirInterface v2.2.1 整数下溢导致拒绝服务 | |
| CVE-2026-117067 | OAI v2.2.1 N2 SCTP 越界访问导致拒绝服务漏洞 | |
| CVE-2026-106806 | Open5GS v2.8.0 HTTP/2 SBI 内存耗尽拒绝服务漏洞 | |
| CVE-2026-106808 | OpenAirInterface v2.2.1 UDM 栈缓冲区溢出漏洞 | |
| CVE-2026-117069 | OpenAirInterface CN5G AMF v2.2.1 整数截断漏洞 | |
| CVE-2026-117127 | GleezCMS v1.2.0 目录遍历漏洞 |