CVE-2025-63288

In Open5GS 2.7.6, AMF crashes when receiving an abnormal NGSetupRequest message, resulting in denial of service

High · published November 10, 2025

CVSS v3.1
7.5
EPSS
0%
Percentile
26.1
In the wild
Unconfirmed
What it is

⚡ Just one malformed NGSetupRequest message can bring the entire Open5GS 2.7.6 system crashing down! Think of it like a restaurant — a single poorly written order slips through, and the kitchen is thrown into chaos, halting service for everyone. Just as a kitchen can't function with a flood of incorrect tickets, your system can’t handle this unexpected message gracefully. If exploited, this vulnerability can cause a denial of service, leaving your network non-responsive when it matters most. Imagine users unable to connect or make calls — absolutely devastating for communications!

Put simply

Think of it like a restaurant — a single poorly written order slips through, and the kitchen is thrown into chaos, halting service for everyone. Just as a kitchen can't function with a flood of incorrect tickets, your system can’t handle this unexpected message gracefully. The vulnerability in Open5GS 2.7.6 occurs when the AMF crashes upon receiving an abnormal NGSetupRequest message, leading to a service outage.

What to do

If exploited, this vulnerability can cause a denial of service, leaving your network non-responsive when it matters most. Imagine users unable to connect or make calls — absolutely devastating for communications! To protect yourself, update Open5GS to the latest version immediately and monitor for any unusual message patterns. Implement input validation to filter abnormal requests before they reach the AMF. You've got this! With these steps, you're well on your way to securing your network. 🛡️

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00340 · 26.1th percentile
Published
2025-11-10T00:00Z
EPSS history
Timeline
  • 10 NOV 00:00Z
    In Open5GS 2.7.6, AMF crashes when receiving an abnormal NGSetupRequest message, resulting in denial of service
    cvelistv5