CVE-2023-23846 - CVE House
Back to Database
Status published Unknown CVE-2023-23846

Due to insufficient length validation in the Open5GS GTP library...

Vulnerability Description

Due to insufficient length validation in the Open5GS GTP library versions prior to versions 2.4.13 and 2.5.7, when parsing extension headers in GPRS tunneling protocol (GPTv1-U) messages, a protocol payload with any extension header length set to zero causes an infinite loop. The affected process becomes immediately unresponsive, resulting in denial of service and excessive resource consumption. CVSS3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2023-23846

Credits & Attribution

No credits recorded in the NVD database.

References

More from Open5GS

View All →
CVE-2023-4885
Multiple vulnerabilities in Open5GS
Medium 6.5
CVE-2023-4884
Multiple vulnerabilities in Open5GS
Medium 6.5
CVE-2023-4883
Multiple vulnerabilities in Open5GS
High 7.5
CVE-2023-4882
Multiple vulnerabilities in Open5GS
High 7.5
CVE-2022-39063
When Open5GS UPF receives a PFCP Session Establishment Request, it...
High 7.5

Affected Vendor

Affected Software

Open5GS
Vulnerable Versions:
<= 2.4.12, <= 2.5.6

Timeline

Official Publish: February 1st, 2023
Last Modified: March 27th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

No vector data available

Weaknesses (CWE)

CWE-770

MITRE ATT&CK TTPs

T1499 Endpoint Denial of Service
Impact
T1498 Network Denial of Service
Impact
T1190 Exploit Public-Facing Application
Initial Access
T1562 Impair Defenses
Defense Evasion
T1046 Network Service Discovery
Discovery