{"id":"CVE-2026-116543","aliases":["GHSA-25v2-v588-jq8g"],"url":"https://o3.security/vulnerability/CVE-2026-116543","summary":"Open5GS 1.3.0 through 2.8.0 Heap Out-of-Bounds Write via SBI Multipart Parser","details":"Open5GS 1.3.0 through 2.8.0 contains a heap out-of-bounds write vulnerability in parse_multipart() that allows unauthenticated attackers to corrupt memory by supplying an empty multipart boundary. Attackers can send a single crafted multipart/related request to the SBI interface of any network function, overflowing the lookbehind buffer and crashing it.","published":"2026-10-26T14:59:42.212Z","modified":"2026-10-27T07:19:27.637194785Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[],"fix":{"url":"https://github.com/open5gs/open5gs/commit/6820c2743b5b5e126e3755d2f92dae2b236732df","label":"open5gs/open5gs@6820c27"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/116xxx/CVE-2026-116543.json"},{"type":"PACKAGE","url":"https://github.com/open5gs/open5gs"},{"type":"ARTICLE","url":"https://github.com/open5gs/open5gs/blob/v2.8.0/lib/sbi/contrib/multipart_parser.c#L260"},{"type":"ARTICLE","url":"https://github.com/open5gs/open5gs/blob/v2.8.0/lib/sbi/message.c#L3372"},{"type":"FIX","url":"https://github.com/open5gs/open5gs/commit/6820c2743b5b5e126e3755d2f92dae2b236732df"},{"type":"ADVISORY","url":"https://github.com/open5gs/open5gs/security/advisories/GHSA-25v2-v588-jq8g"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116543"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/open5gs-1.3.0-through-2.8.0-heap-out-of-bounds-write-via-sbi-multipart-parser"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-27T07:19:27.637194785Z"}}