{
  "affected": [
    {
      "ranges": [
        {
          "database_specific": {
            "extracted_events": [
              {
                "introduced": "Open5GS"
              },
              {
                "fixed": "2.8.0"
              }
            ],
            "source": [
              "DESCRIPTION",
              "REFERENCES"
            ]
          },
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "157f611a530e292e40ec50f9d23f0ef5d4fcd6a6"
            },
            {
              "fixed": "346ce7a5e5cf2812bac3af042b5afba35bcf4f89"
            }
          ],
          "repo": "https://github.com/open5gs/open5gs",
          "type": "GIT"
        }
      ]
    }
  ],
  "aliases": [
    "GHSA-9crh-64c8-56q6"
  ],
  "database_specific": {
    "cna_assigner": "VulnCheck",
    "cwe_ids": [
      "CWE-617"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/108xxx/CVE-2026-108105.json"
  },
  "details": "Open5GS through 2.8.0 contains a reachable assertion vulnerability in mme_gn_handle_sgsn_context_request() that allows remote unauthenticated attackers to crash the MME via malformed SGSN Address IEs. Attackers sending GTPv1-C traffic from a configured SGSN address with a known UE IMSI or P-TMSI can supply an invalid address length to terminate open5gs-mmed, denying service to all subscribers.",
  "id": "CVE-2026-108105",
  "modified": "2026-10-11T02:30:32.066233665Z",
  "published": "2026-10-09T14:08:16.163Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/108xxx/CVE-2026-108105.json"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/open5gs/open5gs/security/advisories/GHSA-9crh-64c8-56q6"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-108105"
    },
    {
      "type": "ADVISORY",
      "url": "https://www.vulncheck.com/advisories/open5gs-through-2.8.0-mme-reachable-assertion-via-gtpv1-sgsn-context-request"
    },
    {
      "type": "FIX",
      "url": "https://github.com/open5gs/open5gs/commit/346ce7a5e5cf2812bac3af042b5afba35bcf4f89"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/open5gs/open5gs"
    },
    {
      "type": "ARTICLE",
      "url": "https://github.com/open5gs/open5gs/blob/v2.8.0/src/mme/mme-gn-handler.c#L208-L217"
    }
  ],
  "schema_version": "1.9.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Open5GS through 2.8.0 MME Reachable Assertion via GTPv1 SGSN Context Request"
}