Open5GS CVE-2026-8222

Q: What is the CVSS score of CVE-2026-8222?

CVE-2026-8222 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-28959 MEDIUM

Improper Resource Shutdown or Release (CWE-404)

2026-05-10 cna@vuldb.com

GHSA-xm8g-256c-hjqj

Denial Of Service Open5gs

5.5

CVSS 4.0 · Vendor: vuldb

Severity by source

Vendor (vuldb) PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (vuldb) · only source for this CVE.

CVSS VectorVendor: vuldb

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

May 10, 2026 - 03:30 vuln.today

CVE Published

May 10, 2026 - 03:16 nvd

MEDIUM 5.5

DescriptionCVE.org

A vulnerability has been found in Open5GS up to 2.7.7. Affected is the function pcf_nbsf_management_handle_register of the file src/pcf/nbsf-handler.c of the component sm-policies Endpoint. Such manipulation leads to denial of service. The attack may be performed from remote. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet.

AnalysisAI

Remote denial of service in Open5GS up to version 2.7.7 affects the sm-policies endpoint's pcf_nbsf_management_handle_register function, allowing unauthenticated network attackers to trigger a crash or service disruption with low attack complexity. Publicly available exploit code exists and the vendor was notified early but has not released a fix.

Technical ContextAI

Open5GS is an open-source implementation of 3GPP 5G core network functions. The vulnerability resides in the Policy Control Function (PCF) component, specifically in the Network Exposure and Slice Selection Function (NBSF) handler that processes sm-policies endpoint requests. The pcf_nbsf_management_handle_register function in src/pcf/nbsf-handler.c fails to properly validate or handle certain input conditions (CWE-404: Improper Resource Validation), leading to denial of service when malformed or unexpected messages are sent to this endpoint. The sm-policies endpoint is part of the PCF's communication interface with other 5G network elements.

RemediationAI

Upgrade Open5GS to a version newer than 2.7.7 when available. As of the current analysis, the vendor has not released a patched version despite early notification - monitor the GitHub repository (https://github.com/open5gs/open5gs/) and the issue tracker (https://github.com/open5gs/open5gs/issues/4437) for fix announcements. As an interim compensating control, restrict network access to the PCF sm-policies endpoint (typically port 7777 or configured service port) using firewall rules or network segmentation, limiting connections to trusted upstream 5G elements (HSS, SPGW, UPF) and blocking direct external exposure. If the PCF is not actively used in your deployment, disabling the nbsf-handler or the sm-policies service endpoint reduces attack surface. Be aware that restricting access may impact legitimate 5G network communications if the PCF is in active use.