Is there a public PoC exploit available for CVE-2026-8288?

Yes, a public proof-of-concept exploit is available for CVE-2026-8288. Prioritise patching immediately. EPSS: 0.1%.

Is there a patch available for CVE-2026-8288?

Yes, a patch is available for CVE-2026-8288. Update the affected software to the latest version immediately.

Open5GS CVE-2026-8288

Q: What is the CVSS score of CVE-2026-8288?

CVE-2026-8288 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-29050 LOW

Improper Resource Shutdown or Release (CWE-404)

2026-05-11 VulDB

GHSA-x779-6vcw-95p6

Denial Of Service Open5gs

2.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

May 11, 2026 - 13:22 NVD

MEDIUM LOW

CVSS changed

May 11, 2026 - 13:22 NVD

4.3 (MEDIUM) 2.1 (LOW)

Source Code Evidence Fetched

May 11, 2026 - 12:45 vuln.today

Analysis Generated

May 11, 2026 - 12:45 vuln.today

CVE Published

May 11, 2026 - 12:15 nvd

MEDIUM 4.3

DescriptionCVE.org

A vulnerability was determined in Open5GS up to 2.7.7. This affects the function gsm_handle_pdu_session_modification_qos_flow_descriptions of the file src/smf/gsm-handler.c of the component SMF. Executing a manipulation of the argument n1SmMsg can lead to denial of service. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized. The pull request to fix this issue awaits acceptance.

AnalysisAI

Denial of service in Open5GS SMF (Session Management Function) via crafted PDU Session Modification messages allows remote authenticated attackers to trigger unvalidated parameter processing in gsm_handle_pdu_session_modification_qos_flow_descriptions(), causing service disruption. The vulnerability stems from insufficient pre-validation of QoS flow parameter identifiers and bitrate units before state mutation, potentially leaving the SMF in an inconsistent state. Publicly available exploit code exists, and a fix awaits upstream acceptance in PR #4513.

Technical ContextAI

Open5GS is a 5G core network implementation. The SMF (Session Management Function) handles PDU Session Modification Requests from user equipment (UE), which include QoS (Quality of Service) flow descriptions with parameters such as 5QI (5G QoS Identifier), GFBR (Guaranteed Flow Bit Rate), and MFBR (Maximum Flow Bit Rate). The vulnerable function gsm_handle_pdu_session_modification_qos_flow_descriptions() in src/smf/gsm-handler.c processes the n1SmMsg argument containing these flow descriptions. The root cause (CWE-404: Improper Resource Validation) manifests as missing pre-validation of QoS parameter identifiers against spec-defined values (TS 24.501 §9.11.4.12) and bitrate unit validation against the range OGS_NAS_BR_UNIT_1K to OGS_NAS_BR_UNIT_256P (TS 24.501 §9.11.4.13). Without pre-validation, malformed parameters cause premature exit mid-loop after partial state mutations, leaving the SMF's bitrate table in an inconsistent state that can only be recovered by detach/re-attach cycles.

RemediationAI

Apply the fix from GitHub PR #4513 (https://github.com/open5gs/open5gs/pull/4513), which implements a two-pass validation strategy: Pass 1 pre-validates all QoS flow parameter identifiers (5QI, GFBR uplink/downlink, MFBR uplink/downlink) and bitrate units against 3GPP TS 24.501 spec ranges before any state mutation occurs; Pass 2 applies validated descriptions without further checks. Exact patched version not independently confirmed from provided data, but the upstream PR provides the complete fix. Interim workarounds pending patch deployment: (1) restrict PDU Session Modification message processing to trusted UE sources only via network-layer firewall rules (trade-off: may block legitimate roaming partners); (2) implement rate-limiting on PDU Session Modification requests per UE (trade-off: may delay legitimate QoS adjustments); (3) monitor SMF logs for 'Invalid bitrate unit' or 'Unknown qos_flow parameter identifier' errors and isolate offending UE sessions (trade-off: requires operational overhead and may impact user experience). Most robust immediate mitigation is to pull and build from the PR #4513 branch directly if stable release is not available.