Is there a public PoC exploit available for CVE-2026-8121?

Yes, a public proof-of-concept exploit is available for CVE-2026-8121. Prioritise patching immediately. EPSS: 0.1%.

Open5GS CVE-2026-8121

Q: What is the CVSS score of CVE-2026-8121?

CVE-2026-8121 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-28479 LOW

Improper Resource Shutdown or Release (CWE-404)

2026-05-08 VulDB

GHSA-m782-cq9r-w5vf

Denial Of Service Open5gs

2.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

May 08, 2026 - 01:30 vuln.today

Severity Changed

May 08, 2026 - 01:22 NVD

MEDIUM LOW

CVSS changed

May 08, 2026 - 01:22 NVD

4.3 (MEDIUM) 2.1 (LOW)

CVE Published

May 08, 2026 - 00:30 nvd

LOW 2.1

DescriptionCVE.org

A vulnerability has been found in Open5GS up to 2.7.7. The impacted element is the function ogs_sbi_parse_plmn_list in the library /lib/sbi/conv.c of the component NSSF. The manipulation leads to denial of service. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet.

AnalysisAI

Denial of service in Open5GS up to version 2.7.7 allows authenticated remote attackers to crash the NSSF (Network Slice Selection Function) component via a crafted PLMN list in the SBI (Service Based Interface) parser. The vulnerability exists in the ogs_sbi_parse_plmn_list function within /lib/sbi/conv.c and has been publicly disclosed with exploit code available; the vendor has not yet released a patch despite early notification.

Technical ContextAI

Open5GS is an open-source 5G core network implementation. The vulnerability resides in the NSSF (Network Slice Selection Function), a critical 5G network slice selection component that processes Service Based Interface (SBI) messages. The flaw is in the PLMN (Public Land Mobile Network) list parsing function, which improperly handles malformed input, leading to an availability impact. CWE-404 (Improper Resource Validation) indicates insufficient validation of resource parameters, allowing an attacker to send a specially crafted message that causes the parser to fail ungracefully. This affects the core SBI communication layer used across 5G microservices.

RemediationAI

Immediate patched version not yet available; the vendor has not released a fix despite early disclosure. Users should monitor the Open5GS GitHub repository (https://github.com/open5gs/open5gs/) for security updates. As an interim compensating control, restrict network access to NSSF SBI endpoints to only trusted, authenticated network functions through firewall rules and mutual TLS certificate pinning; disable NSSF if it is not actively required in your network slice selection topology. Additionally, implement rate limiting on SBI message parsing to detect and drop repetitive malformed PLMN list messages. These controls trade off some operational flexibility (rejected legitimate messages if misconfigured) and administrative overhead (TLS management) but significantly reduce exploitation probability. Given the public exploit and lack of patch, apply defense-in-depth: if NSSF cannot be patched within 30 days, consider temporarily deploying it in an isolated test environment only, or substitute with an alternative 5G core implementation if operationally feasible. Monitor NSSF process logs for parser errors as a detection signal.