CVE-2026-91855

MediumCVSS 5.3/10Last modified Sep 16, 2026

Description

A security flaw has been discovered in Open5GS up to 2.7.7. Affected by this vulnerability is an unknown functionality of the file lib/pfcp/handler.c of the component PFCP Message Handler. Performing a manipulation results in denial of service. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks. The patch is named 028e1dbb5e3271035ccee906ef417a97fc523f71. Applying a patch is the recommended action to fix this issue. CVE-2025-29339 describes a different assertion failure vulnerability in Open5GS UPF.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Weakness enumeration

CWE-404

Affected software

No affected versions have been published.

Timeline

Published
Sep 15, 2026
Last modified
Sep 16, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-918575.3Affected versions of MISP expose several state-changing controller actions without restricting them to POST. The affected actions are: CVE-2026-918586.5FopProducer transforms the incoming XSL-FO message body by creating a javax.xml.transform.TransformerFactory through TransformerFactory.newICVE-2026-918595.3Affected versions of MISP can record incorrect access-log data for requests that terminate in an exception. Because CakeErrorController exCVE-2026-91866.5IBM Langflow OSS 1.0.0 through 1.11.2 allows remote authenticated attackers to bypass localhost-only MCP configuration installation by spoofCVE-2026-918606.3A prototype pollution vulnerability exists in the deep merge helpers of Vaadin Charts and Vaadin Component Base. Merging an object the appliCVE-2026-918626.4The Getwid – Gutenberg Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'data-image-points' parameter in allCVE-2026-918637.5A specially crafted WS-Policy document with deeply nested policy elements can bypass Neethi's nesting-depth limit and exhaust the thread staCVE-2026-918647.5A specially crafted WS-Policy document can pack unlimited content inside a policy assertion, which Neethi copies into memory without countinCVE-2026-918657.5A small WS-Policy document using repeated policy references can force Neethi to re-expand the same references exponentially during normalizaCVE-2026-918667.5A specially crafted pair of WS-Policy documents can force Neethi's policy-intersection to do exponential amounts of work, pinning the CPU foCVE-2026-918674.3When Neethi fetches a remote policy reference, it only limits the time per read, not the whole transfer, so a server that trickles bytes sloCVE-2026-91875.3The Abandoned Contact Form 7 plugin for WordPress is vulnerable to unauthorized arbitrary post deletion in versions up to, and including, 2.