Open5GS UPF CVE-2026-8187

Q: What is the CVSS score of CVE-2026-8187?

CVE-2026-8187 has a CVSS 4.0 base score of 6.9 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-28911 MEDIUM

Uncontrolled Resource Consumption (CWE-400)

2026-05-09 cna@vuldb.com

GHSA-rr89-wx3j-43cc

Denial Of Service Open5gs

6.9

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

6.9 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

May 09, 2026 - 11:30 vuln.today

CVE Published

May 09, 2026 - 11:16 nvd

MEDIUM 6.9

DescriptionCVE.org

A flaw has been found in Open5GS up to 2.7.7. This impacts the function _gtpv1_u_recv_cb of the file src/upf/gtp-path.c of the component UPF. Executing a manipulation can lead to resource consumption. The attack may be performed from remote. The project was informed of the problem early through an issue report but has not responded yet.

AnalysisAI

Denial of service in Open5GS User Plane Function (UPF) up to version 2.7.7 allows remote, unauthenticated attackers to exhaust server resources through manipulation of GTPv1-U packet handling in the _gtpv1_u_recv_cb function. The vulnerability enables resource consumption attacks against 5G core network infrastructure without requiring authentication or user interaction. Vendor notification occurred via GitHub issue #4492 but has not received developer response or a released patch.

Technical ContextAI

Open5GS is a 3GPP-compliant 5G core network implementation. The User Plane Function (UPF) component handles packet forwarding and GTP tunnel termination between radio access networks and data networks. The vulnerability resides in the GTPv1-U packet receiver callback function (_gtpv1_u_recv_cb) located in src/upf/gtp-path.c. GTPv1-U is a tunneling protocol defined in 3GPP TS 29.281 that encapsulates user traffic over UDP. The flaw allows attackers to trigger improper resource allocation or consumption without authentication, exploiting the stateless nature of UDP and lack of ingress validation on the GTPv1-U port (typically UDP 2152). CWE-400 (Uncontrolled Resource Consumption) indicates the root cause is insufficient rate limiting or resource bounds checking in packet processing logic.

RemediationAI

No vendor-released patch identified at time of analysis. Upgrade Open5GS to the latest available version (beyond 2.7.7) if released; check https://github.com/open5gs/open5gs/releases for security advisories. Interim compensating controls: (1) Restrict GTPv1-U UDP port 2152 at the network perimeter to trusted SGi-LAN, S1-U, and S5/S8 gateway sources only - this is standard practice but must be strictly enforced to prevent external attackers from reaching the UPF. (2) Implement rate limiting on GTPv1-U packet ingestion at the UPF OS level using iptables or nftables to drop excessive packets from single sources. (3) Monitor UPF process CPU and memory usage for anomalies indicating resource exhaustion; configure alerting to detect DoS patterns. (4) Isolate UPF instances in a DMZ or private network segment inaccessible from the internet. (5) If patched versions become available, test and deploy immediately to restore full resilience. Network segmentation is the strongest control; resource limiting buys time for a patch.