Is there a public PoC exploit available for CVE-2026-8291?

Yes, a public proof-of-concept exploit is available for CVE-2026-8291. Prioritise patching immediately. EPSS: 0.1%.

Is there a patch available for CVE-2026-8291?

Yes, a patch is available for CVE-2026-8291. Update the affected software to the latest version immediately.

Open5GS CVE-2026-8291

Q: What is the CVSS score of CVE-2026-8291?

CVE-2026-8291 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-29089 LOW

Improper Resource Shutdown or Release (CWE-404)

2026-05-11 VulDB

GHSA-xg8c-hf2j-jjw5

Denial Of Service Open5gs

2.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

May 11, 2026 - 16:22 NVD

MEDIUM LOW

CVSS changed

May 11, 2026 - 16:22 NVD

4.3 (MEDIUM) 2.1 (LOW)

Source Code Evidence Fetched

May 11, 2026 - 15:47 vuln.today

Analysis Generated

May 11, 2026 - 15:47 vuln.today

CVE Published

May 11, 2026 - 13:30 nvd

MEDIUM 4.3

DescriptionCVE.org

A weakness has been identified in Open5GS up to 2.7.7. Impacted is the function ogs_nnrf_nfm_handle_nf_profile of the file lib/sbi/nnrf-handler.c of the component NRF. This manipulation causes denial of service. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks. The pull request to fix this issue awaits acceptance.

AnalysisAI

Denial of service in Open5GS NRF component up to version 2.7.7 allows remote authenticated attackers to exhaust the nf_service memory pool via the ogs_nnrf_nfm_handle_nf_profile function, causing the process to abort via failed assertion. Publicly available exploit code exists, and a vendor patch is available but awaits acceptance into the main branch.

Technical ContextAI

Open5GS is a 5G core network implementation. The vulnerability resides in the NRF (Network Repository Function) component's SBI (Service-Based Interface) handler, specifically in the ogs_nnrf_nfm_handle_nf_profile function within lib/sbi/nnrf-handler.c. The root cause (CWE-404: Improper Resource Validation) involves the use of ogs_assert() statements without graceful bounds checking when allocating nf_service objects from a fixed-size memory pool. When processing NF (Network Function) profile registration messages over the network, the handler attempts to add nf_service entries to both nfServices and legacy nfServiceList structures without verifying pool exhaustion. An exhausted pool returns NULL, but the code asserts rather than handles this gracefully, causing an abnormal termination. The fix replaces assertions with proper NULL checks and truncates the service list (cap-and-break pattern) rather than aborting.

RemediationAI

Apply the vendor patch from PR #4534 (https://github.com/open5gs/open5gs/pull/4534) once it is merged and released. The fix replaces ogs_assert() calls in ogs_nnrf_nfm_handle_nf_profile and ogs_sbi_nf_service_add with proper NULL checks that gracefully handle nf_service pool exhaustion by logging an error and truncating the service list rather than aborting the process. Until a patched release is available, implement rate limiting on NF profile registration requests at the SBI interface boundary to prevent rapid pool exhaustion. Configure firewalls or API gateways to restrict NRF access to authenticated, expected Network Functions only, reducing the likelihood of receiving malicious registration messages. Monitor Open5GS logs for 'nf_service_pool exhausted' error messages, which indicate exploitation attempts. Apply authentication and authorization controls to ensure only legitimate 5G core functions can register with the NRF. The trade-off of rate limiting is potential delayed registration of legitimate NFs during high-volume scenarios, but this is preferable to complete NRF unavailability.