UNKNOWN NVD
CVE-2026-106806
A memory exhaustion issue exists in Open5GS v2.8.0 in the HTTP/2 SBI server. Repeated header names cause previously allocated header strings to be leaked, and H
A memory exhaustion issue exists in Open5GS v2.8.0 in the HTTP/2 SBI server. Repeated header names cause previously allocated header strings to be leaked, and HPACK compression allows an unauthenticated remote attacker to trigger tens of thousands of duplicate headers with a small request. Repeated crafted requests can cause persistent heap growth, exhaust process memory, and terminate the affected Open5GS network function, resulting in denial of service.
References
- https://gist.github.com/hackeryounow/c923fad9de83011004bd7d078b817dc0
- https://github.com/open5gs/open5gs/commit/76f15375ead1b2db09193458e56640da0a86c255
- https://github.com/open5gs/open5gs/issues/4788
This unknown severity vulnerability was published on 2026-11-02 via NVD.
vulnfeed aggregates 17711 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.