Open5GS SGWC v2.7.6 Remote DoS via S11 Transaction Timeout

Critical Vulnerability Information Vulnerability Title Open5GS SGWC v2.7.6 Denial of Service Description SGW-C can be forced to abort (SIGABRT / core dumped) if a ModifyBearerResponse is delivered on S5-C after the corresponding S11 transaction has already timed out and been freed. The handler expects to retrieve a valid associated S11 transaction ( ), but when the S11-side transaction is stale/expired, becomes NULL and the code triggers , crashing . This results in a remote DoS condition for any attacker who can simulate MME/PGW behavior and control message timing. Discoverer Ziyu Lin, Xiaofeng Wang, Wei Dong (Nanyang Technological University) CVSS Score CVSS3.1: AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Reproduction Steps 1. Start a new Go project inside a new folder: 2. Create a and paste the code provided (not shown in this screenshot) Attack Flow 1. MME -> SGW-C: CreateSessionRequest (establish session) 2. PGW: Respond to CreateSessionRequest 3. MME -> SGW-C: ModifyBearerRequest (creates S11 transaction) 4. SGW-C -> PGW: ModifyBearerRequest (creates S5c transaction, associated with S11) 5. Wait for S11 transaction to timeout (don't respond from MME side) 6. PGW -> SGW-C: ModifyBearerResponse (S11 transaction already expired)

Goal Reached Thanks to every supporter — we hit 100%!

Open5GS SGWC v2.7.6 Remote DoS via S11 Transaction Timeout