CVE-2025-15528

Open5GS GTPv2 Bearer Response denial of service

HIGH
7.5
CVSS Score
Published: January 16, 2026 at 10:02 PM UTC
Updated: June 17, 2026 at 08:37 AM UTC
1 product affected across 1 vendorOpen5GS

Using Open5GS by N/A?

Get instant alerts when new vulnerabilities affect Open5GS - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Severity
HIGH7.5
Exploit prediction
EPSS 0.9%
SSVC
PoC

Description

A vulnerability has been found in Open5GS up to 2.7.6. Affected by this vulnerability is an unknown functionality of the component GTPv2 Bearer Response Handler. Such manipulation leads to denial of service. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The name of the patch is 98f76e98df35cd6a35e868aa62715db7f8141ac1. A patch should be applied to remediate this issue.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Remediation

No guide yet

No remediation guidance has been written for this CVE yet. What the record does show:

References (10)

VDB EntryTechnical DescriptionThird Party Advisory
Source: cverecord
https://vuldb.com/?id.341595
SignaturePermissions RequiredVDB Entry
Source: cverecord
https://vuldb.com/?ctiid.341595
Third Party AdvisoryVDB Entry
Source: cverecord
https://vuldb.com/?submit.728128
Issue TrackingExploitVendor Advisory
Source: cverecord
https://github.com/open5gs/open5gs/issues/4225
ExploitIssue TrackingVendor Advisory
Source: cverecord
https://github.com/open5gs/open5gs/issues/4225#issue-3769531006
Third Party Advisory
Source: cverecord
https://vuldb.com/?submit.729359
Third Party Advisory
Source: cverecord
https://vuldb.com/?submit.729360

SSVC — Action Prioritization

SSVCPoCAutomatablePartial impact

SSVC signals action urgency (what to patch first), separate from CVSS which measures severity.

CVSS

Attack Vector
NETWORK
Complexity
LOW
Privileges
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
NONE
Integrity
NONE
Availability
HIGH
Vector?

Quick Info

StatusMODIFIED
CWE
CWE-404

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Free plan, no card