Open5GS CVE-2026-8224

Q: What is the CVSS score of CVE-2026-8224?

CVE-2026-8224 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-28960 MEDIUM

Improper Resource Shutdown or Release (CWE-404)

2026-05-10 cna@vuldb.com

GHSA-x82j-9gmv-pv8w

Denial Of Service Open5gs

5.5

CVSS 4.0 · Vendor: vuldb

Severity by source

Vendor (vuldb) PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (vuldb) · only source for this CVE.

CVSS VectorVendor: vuldb

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

May 10, 2026 - 03:30 vuln.today

CVE Published

May 10, 2026 - 03:16 nvd

MEDIUM 5.5

DescriptionCVE.org

A vulnerability was determined in Open5GS up to 2.7.7. Affected by this issue is the function pcf_sess_set_ipv6prefix of the file /src/pcf/context.c of the component PCF. Executing a manipulation of the argument SmPolicyContextData.ipv6AddressPrefix can lead to denial of service. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

Denial of service in Open5GS up to version 2.7.7 allows remote unauthenticated attackers to crash the Policy Control Function (PCF) by manipulating the SmPolicyContextData.ipv6AddressPrefix parameter in the pcf_sess_set_ipv6prefix function. The vulnerability has publicly available exploit code and was disclosed despite vendor non-responsiveness, making it a known attack vector against 5G service provider infrastructure.

Technical ContextAI

Open5GS is an open-source 5G core network implementation. The vulnerability exists in the PCF (Policy and Charging Control) component, specifically in the function pcf_sess_set_ipv6prefix located in /src/pcf/context.c. The root cause is a missing or improper validation of the SmPolicyContextData.ipv6AddressPrefix parameter, classified as CWE-404 (Improper Resource Validation). IPv6 address prefix handling is critical in 5G policy management, as it controls session-level address allocation and charging policies. Malformed prefix values can trigger unhandled exceptions or buffer operations that exhaust PCF resources.

RemediationAI

No vendor-released patch has been confirmed at time of analysis due to vendor non-responsiveness. Immediate mitigations include: (1) Upgrade to the latest Open5GS version post-2.7.7 and verify the pcf_sess_set_ipv6prefix function has input validation added; (2) Restrict PCF service network access to known trusted 5G subscriber management entities and operator networks using firewall rules or network segmentation - this limits attack surface if SmPolicyContextData is only sourced from authenticated upstream components; (3) Implement input validation at the application or reverse proxy layer to reject malformed IPv6 address prefix values before they reach the PCF function, specifically enforcing valid IPv6 prefix length (0-128) and CIDR notation compliance; (4) Deploy rate limiting on PCF policy context endpoints to mitigate rapid-fire DoS attempts. Trade-off: network segmentation reduces operational flexibility but is practical in 5G core deployments. Input validation adds latency but is low-cost. Monitor PCF logs for repeated failures in context setting to detect ongoing exploitation attempts.