Nixpkgs security tracker

Untriaged

Permalink CVE-2026-15720

8.6 HIGH

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): None (N)
User Interaction (UI): None (N)
Scope (S): Changed (C)
Confidentiality (C): None (N)
Integrity (I): None (N)
Availability (A): High (H)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): None (N)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): None (N)
Modified Scope (MS): Changed (C)
Modified Integrity (MI): None (N)
Modified Availability (MA): High (H)

created 1 week, 2 days ago Activity log

Created suggestion 1 week, 2 days ago

Pre-auth heap out-of-bounds read in the AMF NAS 5GS mobile-identity handler

In Open5GS through version 2.7.7 a pre-authentication heap out-of-bounds read in the AMF NAS 5GS mobile-identity handler may result in subscriber-wide denial of service.

References

https://github.com/open5gs/open5gs/security/advisories/GHSA-f4mx-3x6p-cfwp vendor-advisory

Affected products

open5gs

=<2.7.7

Matching in nixpkgs

pkgs.open5gs

4G/5G core network components

nixos-unstable 2.7.7
- nixpkgs-unstable 2.7.7
- nixos-unstable-small 2.7.7
nixos-26.05 2.7.7
- nixos-26.05-small 2.7.7
- nixpkgs-26.05-darwin 2.7.7

pkgs.open5gs-webui