CVE-2026-106806

{"id": "CVE-2026-106806", "cveTags": [], "metrics": {}, "affected": [{"source": "cve@mitre.org", "affectedData": [{"vendor": "n/a", "product": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}]}], "published": "2026-11-02T18:18:33.970", "references": [{"url": "https://gist.github.com/hackeryounow/c923fad9de83011004bd7d078b817dc0", "source": "cve@mitre.org"}, {"url": "https://github.com/open5gs/open5gs/commit/76f15375ead1b2db09193458e56640da0a86c255", "source": "cve@mitre.org"}, {"url": "https://github.com/open5gs/open5gs/issues/4788", "source": "cve@mitre.org"}], "vulnStatus": "Deferred", "descriptions": [{"lang": "en", "value": "A memory exhaustion issue exists in Open5GS v2.8.0 in the HTTP/2 SBI server. Repeated header names cause previously allocated header strings to be leaked, and HPACK compression allows an unauthenticated remote attacker to trigger tens of thousands of duplicate headers with a small request. Repeated crafted requests can cause persistent heap growth, exhaust process memory, and terminate the affected Open5GS network function, resulting in denial of service."}], "lastModified": "2026-11-02T19:35:33.347", "sourceIdentifier": "cve@mitre.org"}