CVE-2026-10117

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-10117
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-10117.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2026-10117
Published
2026-05-30T12:30:08.160Z
Modified
2026-06-03T03:54:51.440859926Z
Severity
  • 2.1 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P CVSS Calculator
Summary
Open5GS nghttp2-server.c ogs_pool_id_calloc denial of service
Details

A weakness has been identified in Open5GS up to 2.7.7. This issue affects the function ogspoolid_calloc in the library /lib/sbi/nghttp2-server.c. Executing a manipulation can lead to denial of service. The attack may be launched remotely. The exploit has been made available to the public and could be used for attacks. It is best practice to apply a patch to resolve this issue.

Database specific 
{
    "cwe_ids": [
        "CWE-404"
    ],
    "cna_assigner": "VulDB",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/10xxx/CVE-2026-10117.json",
    "unresolved_ranges": [
        {
            "source": "AFFECTED_FIELD",
            "extracted_events": [
                {
                    "last_affected": "2.7.3"
                },
                {
                    "last_affected": "2.7.4"
                }
            ]
        }
    ]
}
References

Affected packages

Git / github.com/open5gs/open5gs

Affected ranges

Type
GIT
Repo
https://github.com/open5gs/open5gs
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
83e35bb2de7e67646fdba849580184422b10006a
Last affected
426fa3f84a0cb332e9971ad9408935838cf98fa6
Last affected
43fa4857cce8af6b6ec3c8e3b0cbf99444948f76
Last affected
7dfd9a39649700c24c22f1978ed7a35541a72cca
Last affected
d9d3abdd480be96fac3bc8a997e83446648763ca
Last affected
318eeb49a7dcdff733dec60e02d9c60aefca2fb9
Database specific 
{
    "source": "AFFECTED_FIELD",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "2.7.0"
        },
        {
            "last_affected": "2.7.1"
        },
        {
            "last_affected": "2.7.2"
        },
        {
            "last_affected": "2.7.5"
        },
        {
            "last_affected": "2.7.6"
        },
        {
            "last_affected": "2.7.7"
        }
    ]
}

Affected versions

v0.*
v0.1.0
v0.1.1
v0.2.0
v0.3.0
v0.3.1
v0.3.10
v0.3.2
v0.3.3
v0.3.4
v0.3.5
v0.3.6
v0.3.8
v0.4.1
v0.4.2
v0.4.3
v0.4.4
v0.5.0
v0.5.1
v0.5.2
v1.*
v1.0.0
v1.1.0
v1.2.0
v1.2.1
v1.2.2
v1.2.3
v1.2.4
v1.3.0
v2.*
v2.0.0
v2.0.18
v2.0.22
v2.1.0
v2.1.1
v2.1.3
v2.1.4
v2.1.5
v2.1.7
v2.2.0
v2.2.1
v2.2.6
v2.2.7
v2.2.8
v2.2.9
v2.3.0
v2.3.2
v2.3.6
v2.4.0
v2.4.1
v2.4.3
v2.4.4
v2.4.5
v2.4.7
v2.4.8
v2.4.9
v2.6.1
v2.6.2
v2.6.3
v2.6.4
v2.6.6
v2.7.0
v2.7.1
v2.7.2
v2.7.5
v2.7.6
v2.7.7

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-10117.json"