CVE-2026-10117: Open5GS nghttp2-server.c ogs_pool_id_calloc denial of service
A weakness has been identified in Open5GS up to 2.7.7. This issue affects the function ogspoolidcalloc in the library /lib/sbi/nghttp2-server.c. Executing a manipulation can lead to denial of service. The attack may be launched remotely. The exploit has been made available to the public and could be used for attacks. It is best practice to apply a patch to resolve this issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Open5GSto a version that resolves this vulnerability.Fixed in 2.7.7 - Compensating control
Since the denial of service attack may be launched remotely, restrict network access to the Open5GS/nghttp2 server interfaces (e.g., limit inbound traffic to only required sources/ports) while remediation is applied.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-10117?
The severity of CVE-2026-10117 is rated medium at 4.3.
How do I fix CVE-2026-10117?
To fix CVE-2026-10117, update Open5GS to the latest version beyond 2.7.7 where the vulnerability has been addressed.
What type of vulnerability is CVE-2026-10117?
CVE-2026-10117 is a denial of service vulnerability identified in the Open5GS software.
Can CVE-2026-10117 be exploited remotely?
Yes, CVE-2026-10117 can be exploited remotely, making it a significant risk.
In which component of Open5GS is CVE-2026-10117 found?
CVE-2026-10117 is found in the ogs_pool_id_calloc function within the nghttp2-server.c file of Open5GS.