Is there a public PoC exploit available for CVE-2026-10117?

Yes, a public proof-of-concept exploit is available for CVE-2026-10117. Prioritise patching immediately. EPSS: 0.0%.

Open5GS CVE-2026-10117

Q: What is the CVSS score of CVE-2026-10117?

CVE-2026-10117 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-33460 LOW

Improper Resource Shutdown or Release (CWE-404)

2026-05-30 VulDB

GHSA-fh2x-jcf9-hjr5

Denial Of Service Open5gs

2.1

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

May 30, 2026 - 13:22 NVD

MEDIUM LOW

CVSS changed

May 30, 2026 - 13:22 NVD

4.3 (MEDIUM) 2.1 (LOW)

Analysis Generated

May 30, 2026 - 12:58 vuln.today

DescriptionCVE.org

A weakness has been identified in Open5GS up to 2.7.7. This issue affects the function ogs_pool_id_calloc in the library /lib/sbi/nghttp2-server.c. Executing a manipulation can lead to denial of service. The attack may be launched remotely. The exploit has been made available to the public and could be used for attacks. It is best practice to apply a patch to resolve this issue.

AnalysisAI

Denial of service in Open5GS up to version 2.7.7 is triggerable by a low-privileged remote attacker via the ogs_pool_id_calloc function in the SBI nghttp2-server library, causing availability degradation of 5G core network functions. The CVSS temporal modifiers confirm both a public proof-of-concept (E:P) and an official remedy (RL:O). No public exploit identified at time of analysis as confirmed by CISA KEV, but the publicly available PoC on GitHub (issue #4474) materially lowers the exploitation barrier for actors with access to SBI endpoints.

Technical ContextAI

Open5GS is an open-source implementation of the 5G Core Network (5GC) and Evolved Packet Core (EPC). The vulnerable component resides in /lib/sbi/nghttp2-server.c, which implements the Service Based Interface (SBI) - the HTTP/2-based communication layer through which 5G network functions (AMF, SMF, UDM, etc.) interact. The function ogs_pool_id_calloc manages memory pool allocation within this server component. CWE-404 (Improper Resource Shutdown or Release) indicates that the root cause is a failure to properly release or clean up allocated resources under certain input conditions, enabling resource exhaustion. The use of nghttp2 as the HTTP/2 transport library means the attack surface is the SBI HTTP/2 listener, a standard and always-active component in any Open5GS deployment. CPE string cpe:2.3:a:n/a:open5gs:*:*:*:*:*:*:*:* covers all versions up to 2.7.7; the vendor field is listed as 'n/a' in NVD, which is typical for community-maintained open-source projects.

RemediationAI

An official remedy is confirmed available per the CVSS temporal modifier RL:O; operators should upgrade Open5GS beyond version 2.7.7 by consulting the latest release on the upstream GitHub repository at https://github.com/open5gs/open5gs/. The specific patched release version is not confirmed in the available input data - verify the current tagged release before upgrading. The issue is tracked at https://github.com/open5gs/open5gs/issues/4474, which may contain additional context on the fix. As a compensating control prior to patching, restrict SBI interface access exclusively to trusted internal network function addresses using firewall or network policy rules, reducing the pool of actors who can satisfy the PR:L requirement. Rate-limiting HTTP/2 connections to the SBI listener can also reduce the impact of attempted exploitation. Note that SBI restriction controls may interfere with inter-NF communication if not scoped carefully.