Open5GS v2.7.5, prior to commit 67ba7f92bbd7a378954895d96d9d7b05d5b64615, is vulnerable to a NULL pointer dereference when a multipart/related HTTP POST request with an empty HTTP body is sent to the SBI of either AMF, AUSF, BSF, NRF, NSSF, PCF, SMF, UDM, or UDR, resulting in a denial of service. This occurs in the parse_multipart function in lib/sbi/message.c.
References
| Link | Resource |
|---|---|
| https://github.com/open5gs/open5gs/commit/67ba7f92bbd7a378954895d96d9d7b05d5b64615 | Patch |
| https://github.com/open5gs/open5gs/issues/3942 | Exploit Issue Tracking |
| https://github.com/tsiamoulis/vuln-research/tree/main/CVE-2025-55904 | Exploit Third Party Advisory |
Configurations
History
23 Sep 2025, 15:45
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:open5gs:open5gs:*:*:*:*:*:*:*:* | |
| First Time |
Open5gs
Open5gs open5gs |
|
| References | () https://github.com/open5gs/open5gs/commit/67ba7f92bbd7a378954895d96d9d7b05d5b64615 - Patch | |
| References | () https://github.com/open5gs/open5gs/issues/3942 - Exploit, Issue Tracking | |
| References | () https://github.com/tsiamoulis/vuln-research/tree/main/CVE-2025-55904 - Exploit, Third Party Advisory |
17 Sep 2025, 15:15
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 4.0 |
| CWE | CWE-476 |
17 Sep 2025, 14:18
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-09-17 14:15
Updated : 2025-09-23 15:45
NVD link : CVE-2025-55904
Mitre link : CVE-2025-55904
CVE.ORG link : CVE-2025-55904
JSON object : View
Products Affected
open5gs
- open5gs
CWE
CWE-476
NULL Pointer Dereference