{"id":"CVE-2025-15176","aliases":["EUVD-2025-205559","GHSA-229x-w52j-6f5m"],"status":"published","title":"Open5GS PFCP Session Establishment Request rule-match.c ogs_pfcp_pdr_rule_find_by_packet assertion","description":"A flaw has been found in Open5GS up to 2.7.5. This affects the function decode_ipv6_header/ogs_pfcp_pdr_rule_find_by_packet of the file lib/pfcp/rule-match.c of the component PFCP Session Establishment Request Handler. Executing a manipulation can lead to reachable assertion. It is possible to launch the attack remotely. The exploit has been published and may be used. This patch is called b72d8349980076e2c033c8324f07747a86eea4f8. Applying a patch is advised to resolve this issue.","severity":{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00618,"percentile":0.5008,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-617"],"published":"2025-12-29T06:32:06Z","modified":"2026-10-28T10:59:11Z","products":[{"vendor":"open5gs","product":"open5gs"}],"references":[{"url":"https://vuldb.com/?id.338561","tags":["vdb-entry","technical-description","Third Party Advisory","VDB Entry","advisory"]},{"url":"https://vuldb.com/?ctiid.338561","tags":["signature","permissions-required","Permissions Required","VDB Entry","report"]},{"url":"https://vuldb.com/?submit.719830","tags":["third-party-advisory","Exploit","Third Party Advisory","VDB Entry","advisory"]},{"url":"https://github.com/open5gs/open5gs/issues/4180","tags":["issue-tracking","Exploit","Issue Tracking","report"]},{"url":"https://github.com/open5gs/open5gs/issues/4180#issuecomment-3615555671","tags":["issue-tracking","Exploit","Issue Tracking","report"]},{"url":"https://github.com/open5gs/open5gs/issues/4180#issue-3666760066","tags":["exploit","issue-tracking","Exploit","Issue Tracking","report"]},{"url":"https://github.com/open5gs/open5gs/commit/b72d8349980076e2c033c8324f07747a86eea4f8","tags":["patch","Patch","fix"]},{"url":"https://github.com/open5gs/open5gs/","tags":["product","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-15176","tags":["advisory"]},{"url":"https://github.com/open5gs/open5gs"},{"url":"https://github.com/advisories/GHSA-229x-w52j-6f5m"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/15xxx/CVE-2025-15176.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2025-15176","title":"Open5GS PFCP Session Establishment Request rule-match.c ogs_pfcp_pdr_rule_find_by_packet assertion","description":"A flaw has been found in Open5GS up to 2.7.5. This affects the function decode_ipv6_header/ogs_pfcp_pdr_rule_find_by_packet of the file lib/pfcp/rule-match.c of the component PFCP Session Establishment Request Handler. Executing a manipulation can lead to reachable assertion. It is possible to launch the attack remotely. The exploit has been published and may be used. This patch is called b72d8349980076e2c033c8324f07747a86eea4f8. Applying a patch is advised to resolve this issue.","status":"published","published":"2025-12-29T06:32:06.957Z","modified":"2026-02-24T06:10:11.758Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P","level":"medium","assessor":"cna"},{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C","level":"medium","assessor":"cna"},{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C","level":"medium","assessor":"cna"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P/E:POC/RL:OF/RC:C","assessor":"cna"}],"cwes":["CWE-617"],"updated_at":"2026-11-02T14:32:37.351404Z"}],"euvd":[{"id":"EUVD-2025-205559","description":"A flaw has been found in Open5GS up to 2.7.5. This affects the function decode_ipv6_header/ogs_pfcp_pdr_rule_find_by_packet of the file lib/pfcp/rule-match.c of the component PFCP Session Establishment Request Handler. Executing a manipulation can lead to reachable assertion. It is possible to launch the attack remotely. The exploit has been published and may be used. This patch is called b72d8349980076e2c033c8324f07747a86eea4f8. Applying a patch is advised to resolve this issue.","status":"published","published":"2025-12-29T06:32:06Z","modified":"2026-02-24T06:10:11Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P","level":"medium"}],"updated_at":"2026-11-02T19:48:31.290117Z"}],"ghsa":[{"id":"GHSA-229x-w52j-6f5m","title":"A flaw has been found in Open5GS up to 2.7.5. This affects the function decode_ipv6_header...","description":"A flaw has been found in Open5GS up to 2.7.5. This affects the function decode_ipv6_header/ogs_pfcp_pdr_rule_find_by_packet of the file lib/pfcp/rule-match.c of the component PFCP Session Establishment Request Handler. Executing manipulation can lead to reachable assertion. It is possible to launch the attack remotely. The exploit has been published and may be used. This patch is called b72d8349980076e2c033c8324f07747a86eea4f8. Applying a patch is advised to resolve this issue.","status":"published","published":"2025-12-29T09:30:23Z","modified":"2026-02-24T09:32:27Z","cvss":[{"version":"4.0","score":5.5,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"},{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"cwes":["CWE-617"],"updated_at":"2026-11-02T15:06:21.035092Z"}],"nvd":[{"id":"CVE-2025-15176","description":"A flaw has been found in Open5GS up to 2.7.5. This affects the function decode_ipv6_header/ogs_pfcp_pdr_rule_find_by_packet of the file lib/pfcp/rule-match.c of the component PFCP Session Establishment Request Handler. Executing a manipulation can lead to reachable assertion. It is possible to launch the attack remotely. The exploit has been published and may be used. This patch is called b72d8349980076e2c033c8324f07747a86eea4f8. Applying a patch is advised to resolve this issue.","status":"published","published":"2025-12-29T07:15:54.153Z","modified":"2026-10-13T09:10:00.323Z","cvss":[{"version":"4.0","score":5.5,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"},{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"secondary"}],"cwes":["CWE-617"],"updated_at":"2026-11-02T14:11:53.683969Z"}],"osv":[{"id":"CVE-2025-15176","title":"Open5GS PFCP Session Establishment Request rule-match.c ogs_pfcp_pdr_rule_find_by_packet assertion","description":"A flaw has been found in Open5GS up to 2.7.5. This affects the function decode_ipv6_header/ogs_pfcp_pdr_rule_find_by_packet of the file lib/pfcp/rule-match.c of the component PFCP Session Establishment Request Handler. Executing a manipulation can lead to reachable assertion. It is possible to launch the attack remotely. The exploit has been published and may be used. This patch is called b72d8349980076e2c033c8324f07747a86eea4f8. Applying a patch is advised to resolve this issue.","status":"published","published":"2025-12-29T06:32:06.957Z","modified":"2026-10-28T10:59:11.24935695Z","cvss":[{"version":"4.0","score":5.5,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P","level":"medium"}],"cwes":["CWE-617"],"updated_at":"2026-11-02T15:44:46.340268Z"}]}}