CVE-2026-75894
Reachable assertion at ranap_handle_co_dt()
In osmo-iuh from 0.1.0 through 1.8.0 a reachable assertion was found in the ranap_handle_co_dt() function via a arbitrarily sized NAS-PDU that leads to process crash and remote denial of service.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Reachable assertion at ranap_handle_co_dt()
In osmo-iuh from 0.1.0 through 1.8.0 a reachable assertion was found in the ranap_handle_co_dt() function via a arbitrarily sized NAS-PDU that leads to process crash and remote denial of service.
- Record
CVE-2026-75894- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-617, CWE-617
- Updated
- 2026-11-02
EUVDEUVD-2026-83274
In osmo-iuh from 0.1.0 through 1.8.0 a reachable assertion was found in the ranap_handle_co_dt() function via a arbitrarily sized NAS-PDU that leads to process crash and remote denial of service.
- Record
EUVD-2026-83274- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-g4v5-w6q6-j5cq
In osmo-iuh from 0.1.0 through 1.8.0 a reachable assertion was found in the ranap_handle_co_dt()...
In osmo-iuh from 0.1.0 through 1.8.0 a reachable assertion was found in the ranap_handle_co_dt() function via a arbitrarily sized NAS-PDU that leads to process crash and remote denial of service.
- Record
GHSA-g4v5-w6q6-j5cq- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-617
- Updated
- 2026-11-02
NVD
In osmo-iuh from 0.1.0 through 1.8.0 a reachable assertion was found in the ranap_handle_co_dt() function via a arbitrarily sized NAS-PDU that leads to process crash and remote denial of service.
- Record
CVE-2026-75894- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-617
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2026-75894
In osmo-iuh from 0.1.0 through 1.8.0 a reachable assertion was found in the ranap_handle_co_dt() function via a arbitrarily sized NAS-PDU that leads to process crash and remote denial of service.
- Record
DEBIAN-CVE-2026-75894- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2026-75894
In osmo-iuh from 0.1.0 through 1.8.0 a reachable assertion was found in the ranap_handle_co_dt() function via a arbitrarily sized NAS-PDU that leads to process crash and remote denial of service.
- Record
UBUNTU-CVE-2026-75894- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVopenSUSE-SU-2026:21954-1 No score
Security update for osmo-iuh
This update for osmo-iuh fixes the following issues:
Changes in osmo-iuh:
- CVE-2026-75894: iu_client: reject oversized RANAP NAS-PDU (boo#1281607).
- Record
openSUSE-SU-2026:21954-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
osmo-iuhDebian:12 |
All versions, plus listed versions 1.3.0+dfsg1-51.3.0+dfsg1-5.11.3.0+dfsg1-5.1~exp11.3.0+dfsg1-61.3.0+dfsg1-7 Show 7 moreShow less1.6.0+dfsg1-11.6.0+dfsg1-21.7.0+dfsg1-11.7.0+dfsg1-21.7.0+dfsg1-31.8.1+dfsg1-11.8.1+dfsg1-2 |
None known |
osmo-iuhDebian:13 |
All versions, plus listed versions 1.7.0+dfsg1-21.7.0+dfsg1-31.8.1+dfsg1-11.8.1+dfsg1-2 |
None known |
osmo-iuhDebian:14 |
before 1.8.1+dfsg1-2, plus listed versions 1.7.0+dfsg1-21.7.0+dfsg1-31.8.1+dfsg1-1 |
1.8.1+dfsg1-2 |
osmo-iuhUbuntu:20.04:LTS |
All versions, plus listed versions 0.3.0-50.3.0-5ubuntu1 |
None known |
osmo-iuhUbuntu:22.04:LTS |
All versions, plus listed versions 0.6.1+dfsg1-20.6.1+dfsg1-2build2 |
None known |
osmo-iuhUbuntu:24.04:LTS |
All versions, plus listed versions 1.3.0+dfsg1-51.3.0+dfsg1-6 |
None known |
osmo-iuhUbuntu:26.10 |
All versions, plus listed versions 1.7.0+dfsg1-2build11.7.0+dfsg1-3 |
None known |
osmo-iuhUbuntu:26.04:LTS |
All versions, plus listed versions 1.7.0+dfsg1-21.7.0+dfsg1-2build1 |
None known |
osmo-iuhopenSUSE:Leap 16.0 |
before 1.5.1-bp160.2.1 | 1.5.1-bp160.2.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-75894 is a high vulnerability (CVSS 7.5) in Osmocom Osmo-iuh, published September 18, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.31%, the 24th percentile. Fixed in osmo-iuh 1.8.1+dfsg1-2.
References
cgit.osmocom.org/osmo-iuh/commit?id=f06967126f486bcb185ccf3d1a8f9bc02c4da1f6
nvd.nist.gov/vuln/detail/CVE-2026-75894
github.com/advisories/GHSA-g4v5-w6q6-j5cq
security-tracker.debian.org/tracker/CVE-2026-75894
ubuntu.com/security/CVE-2026-75894
cve.org/CVERecord?id=CVE-2026-75894
bugzilla.suse.com/1281607
suse.com/security/cve/CVE-2026-75894