CVE-2026-106806 — Vulnerability intelligence
—
Published:
- CVSS
- Not available
- CISA KEV
- Not listed; not proof of no exploitation
Original source text (not a translation)
A memory exhaustion issue exists in Open5GS v2.8.0 in the HTTP/2 SBI server. Repeated header names cause previously allocated header strings to be leaked, and HPACK compression allows an unauthenticated remote attacker to trigger tens of thousands of duplicate headers with a small request. Repeated crafted requests can cause persistent heap growth, exhaust process memory, and terminate the affected Open5GS network function, resulting in denial of service.