Open5GS CVE-2026-8223

Q: What is the CVSS score of CVE-2026-8223?

CVE-2026-8223 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-28958 MEDIUM

Improper Resource Shutdown or Release (CWE-404)

2026-05-10 cna@vuldb.com

GHSA-q4gr-3x5p-634j

Denial Of Service Open5gs

5.5

CVSS 4.0 · Vendor: vuldb

Severity by source

Vendor (vuldb) PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (vuldb) · only source for this CVE.

CVSS VectorVendor: vuldb

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

May 10, 2026 - 03:30 vuln.today

CVE Published

May 10, 2026 - 03:16 nvd

MEDIUM 5.5

DescriptionCVE.org

A vulnerability was found in Open5GS up to 2.7.7. Affected by this vulnerability is the function pcf_sess_sbi_discover_and_send of the component sm-policies Endpoint. Performing a manipulation results in denial of service. It is possible to initiate the attack remotely. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.

AnalysisAI

Denial of service in Open5GS up to version 2.7.7 via manipulation of the pcf_sess_sbi_discover_and_send function in the sm-policies endpoint allows remote unauthenticated attackers to disrupt service availability. Publicly available exploit code exists, and the upstream project has not yet issued a patch despite early notification via issue report.

Technical ContextAI

Open5GS is a 5G core network implementation that implements Session Plane Function (SPF) and Policy Control Function (PCF) components. The vulnerability resides in the sm-policies endpoint's pcf_sess_sbi_discover_and_send function, which handles Service-Based Interface (SBI) discovery and policy management communication. CWE-404 (Improper Resource Validation) indicates the vulnerability stems from insufficient validation of incoming requests or resources, likely allowing malformed or unexpected input to the sm-policies endpoint to trigger resource exhaustion or unhandled exceptions that crash the PCF service.

RemediationAI

Upgrade Open5GS to the next stable release after 2.7.7 once the upstream project releases a patched version; as of the time of this analysis, no vendor-released patch version has been confirmed. Monitor the official repository at https://github.com/open5gs/open5gs/ for patch releases and subscribe to issue #4438 for updates. As an interim compensating control, restrict network access to the sm-policies SBI endpoint (typically TCP port 7777 or configured port) using firewall rules to only allow traffic from authenticated 5G infrastructure components (NRF, NEF, other core network functions). Implement rate limiting and input validation proxies in front of the PCF service to detect and block malformed policy discovery requests. If immediate upgrade is not possible, isolate the PCF instance behind a WAF or API gateway configured to validate SBI message format and drop requests with invalid Session Management policy data structures.