NULL Pointer Dereference Vulnerability in Open5GS by Open5GS

CVE-2025-55904

What is CVE-2025-55904?

Open5GS versions prior to commit 67ba7f92bbd7a378954895d96d9d7b05d5b64615 are susceptible to a NULL pointer dereference vulnerability. This issue arises when an affected component receives a multipart/related HTTP POST request that includes an empty HTTP body. The vulnerability specifically exists within the parse_multipart function in the lib/sbi/message.c file, potentially leading to denial of service across critical system functions such as AMF, AUSF, BSF, NRF, NSSF, PCF, SMF, UDM, and UDR.

References