Is there a public PoC exploit available for CVE-2026-8225?

Yes, a public proof-of-concept exploit is available for CVE-2026-8225. Prioritise patching immediately. EPSS: 0.0%.

Open5GS CVE-2026-8225

Q: What is the CVSS score of CVE-2026-8225?

CVE-2026-8225 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-28973 MEDIUM

Improper Resource Shutdown or Release (CWE-404)

2026-05-10 VulDB

GHSA-9v4p-7hgj-vmrq

Denial Of Service Open5gs

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

May 10, 2026 - 05:22 NVD

5.3 (MEDIUM) 5.5 (MEDIUM)

Analysis Generated

May 10, 2026 - 05:15 vuln.today

CVE Published

May 10, 2026 - 03:15 nvd

MEDIUM 5.3

DescriptionCVE.org

A vulnerability was identified in Open5GS up to 2.7.7. This affects the function pcf_npcf_smpolicycontrol_handle_delete of the file src/pcf/sm-sm.c of the component delete Endpoint. The manipulation leads to denial of service. The attack can be initiated remotely. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.

AnalysisAI

Denial of service in Open5GS up to version 2.7.7 allows remote unauthenticated attackers to crash the Policy Control Function (PCF) service by sending crafted requests to the delete endpoint in the SM policy control handler (pcf_npcf_smpolicycontrol_handle_delete). The vulnerability has a publicly available proof of concept and impacts the availability of 5G network policy enforcement, though the vendor has not yet released a patch despite early notification.

Technical ContextAI

Open5GS is an open-source implementation of 5G core network functions. The vulnerability resides in the PCF (Policy and Charging Control) component, specifically in the SM (Session Management) policy control handler located at src/pcf/sm-sm.c. The vulnerable function processes HTTP DELETE requests to the smpolicycontrol endpoint, which is part of the 3GPP NPCF (Network Policy Control Function) interface for managing session policies in 5G networks. CWE-404 (Improper Resource Validation) indicates that the code fails to properly validate or handle resources during the delete operation, likely resulting in a null pointer dereference, integer overflow, or unhandled exception when processing malformed or unexpected input.

RemediationAI

No vendor-released patch has been confirmed at the time of analysis, and the project has not responded to early notification per available reports. Recommended mitigations include: (1) Update to the latest available Open5GS version beyond 2.7.7 once released and confirmed to address this issue (monitor the GitHub repository at https://github.com/open5gs/open5gs for updates); (2) If immediate patching is not possible, implement network-level access controls by restricting PCF smpolicycontrol endpoint access to trusted 5G network elements only - use firewall rules or ingress controllers to block DELETE requests to this endpoint from untrusted sources, noting that this may require custom AMF/SMF routing logic to maintain legitimate SM policy updates; (3) Monitor PCF service logs for HTTP 5xx errors or crashes and implement automated service restart with alerting; (4) Deploy PCF in a containerized environment with restart policies to limit denial of service impact duration. Each mitigation trades off between security and operational complexity - network restriction is safest but requires careful architecture review of 5G network flows.