CVE-2026-10565
Open5GS NGAP Handover gmm-sm.c gmm_state_security_mode race condition
Low 2.3 Exploitation: poc
A security flaw has been discovered in Open5GS up to 2.7.6. The impacted element is the function gmm_state_security_mode of the file src/amf/gmm-sm.c of the component NGAP Handover. Performing a manipulation results in race condition. The attack can be initiated remotely. The complexity of an attack is rather high. The exploitability is regarded as difficult. The exploit has been released to the public and may be used for attacks. The pull request to fix this issue awaits acceptance.
Assigner
VulDB
VulDB
Published
2026-06-02
2026-06-02
Updated
2026-10-21
2026-10-21
Reserved
2026-06-01
2026-06-01
Scores
| Source | CVSS | Score | Severity | Vector |
|---|---|---|---|---|
| VulDB | 4.0 | 2.3 | Low | CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P |
| VulDB | 3.1 | 3.1 | Low | CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:C |
| VulDB | 3.0 | 3.1 | Low | CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:C |
| VulDB | 2.0 | 2.1 | AV:N/AC:H/Au:S/C:N/I:N/A:P/E:POC/RL:ND/RC:C |
Weaknesses
Affected
| Vendor | Product | Versions |
|---|---|---|
| n/a | Open5GS | 2.7.0 (affected) 2.7.1 (affected) 2.7.2 (affected) 2.7.3 (affected) 2.7.4 (affected) 2.7.5 (affected) 2.7.6 (affected) |
References
- https://vuldb.com/vuln/367672 vdb-entrytechnical-description
- https://vuldb.com/vuln/367672/cti signaturepermissions-required
- https://vuldb.com/cve/CVE-2026-10565 third-party-advisory
- https://vuldb.com/submit/818938 third-party-advisory
- https://github.com/open5gs/open5gs/issues/4497 issue-tracking
- https://github.com/open5gs/open5gs/pull/4501 issue-trackingpatch
- https://github.com/user-attachments/files/27111025/N2-SMC-Concurrent.zip exploit
- https://github.com/open5gs/open5gs/ product
Full CVE JSON record (5.2)
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-10565",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-06-02T12:22:40.203143Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-06-02T12:22:53.847Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:open5gs:open5gs:*:*:*:*:*:*:*:*"
],
"modules": [
"NGAP Handover"
],
"product": "Open5GS",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "2.7.0"
},
{
"status": "affected",
"version": "2.7.1"
},
{
"status": "affected",
"version": "2.7.2"
},
{
"status": "affected",
"version": "2.7.3"
},
{
"status": "affected",
"version": "2.7.4"
},
{
"status": "affected",
"version": "2.7.5"
},
{
"status": "affected",
"version": "2.7.6"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Seungjoon Na (Kookmin University ICSR Lab)"
},
{
"lang": "en",
"type": "finder",
"value": "Jinha Kim (Kookmin University ICSR Lab)"
},
{
"lang": "en",
"type": "finder",
"value": "Hwankuk Kim (Kookmin University ICSR Lab)"
},
{
"lang": "en",
"type": "reporter",
"value": "Seungjoon Na (VulDB User)"
},
{
"lang": "en",
"type": "analyst",
"value": "Seungjoon Na (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A security flaw has been discovered in Open5GS up to 2.7.6. The impacted element is the function gmm_state_security_mode of the file src/amf/gmm-sm.c of the component NGAP Handover. Performing a manipulation results in race condition. The attack can be initiated remotely. The complexity of an attack is rather high. The exploitability is regarded as difficult. The exploit has been released to the public and may be used for attacks. The pull request to fix this issue awaits acceptance."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 2.3,
"baseSeverity": "LOW",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 3.1,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 3.1,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 2.1,
"vectorString": "AV:N/AC:H/Au:S/C:N/I:N/A:P/E:POC/RL:ND/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-362",
"description": "Race Condition",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T09:02:05.612Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-367672 | Open5GS NGAP Handover gmm-sm.c gmm_state_security_mode race condition",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/367672"
},
{
"name": "VDB-367672 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/367672/cti"
},
{
"name": "CVE-2026-10565 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-10565"
},
{
"name": "Submit #818938 | open5gs v2.7.6 Race Condition",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/818938"
},
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/open5gs/open5gs/issues/4497"
},
{
"tags": [
"issue-tracking",
"patch"
],
"url": "https://github.com/open5gs/open5gs/pull/4501"
},
{
"tags": [
"exploit"
],
"url": "https://github.com/user-attachments/files/27111025/N2-SMC-Concurrent.zip"
},
{
"tags": [
"product"
],
"url": "https://github.com/open5gs/open5gs/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-06-01T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-06-01T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-10-21T11:06:55.000Z",
"value": "VulDB entry last update"
}
],
"title": "Open5GS NGAP Handover gmm-sm.c gmm_state_security_mode race condition",
"x_generator": [
"VulDB PVTS v202610"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-10565",
"datePublished": "2026-06-02T01:30:09.909Z",
"dateReserved": "2026-06-01T16:31:37.602Z",
"dateUpdated": "2026-10-21T09:02:05.612Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}