Is there a public PoC exploit available for CVE-2026-8292?

Yes, a public proof-of-concept exploit is available for CVE-2026-8292. Prioritise patching immediately. EPSS: 0.0%.

Open5GS CVE-2026-8292

Q: What is the CVSS score of CVE-2026-8292?

CVE-2026-8292 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-29090 LOW

Improper Resource Shutdown or Release (CWE-404)

2026-05-11 VulDB

GHSA-6673-jrvf-qrvq

Denial Of Service Open5gs

2.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

May 11, 2026 - 16:22 NVD

MEDIUM LOW

CVSS changed

May 11, 2026 - 16:22 NVD

4.3 (MEDIUM) 2.1 (LOW)

Analysis Generated

May 11, 2026 - 15:47 vuln.today

CVE Published

May 11, 2026 - 15:00 nvd

MEDIUM 4.3

DescriptionCVE.org

A security vulnerability has been detected in Open5GS up to 2.7.7. The affected element is the function yuarel_parse in the library /lib/sbi/conv.c of the component NRF. Such manipulation of the argument hnrf-uri leads to denial of service. The attack may be performed from remote. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.

AnalysisAI

Denial of service in Open5GS up to version 2.7.7 allows authenticated remote attackers to crash the NRF component by manipulating the hnrf-uri argument passed to the yuarel_parse function in /lib/sbi/conv.c. The vulnerability has a publicly available exploit and low CVSS score (4.3) due to authentication requirement and limited scope, but affects a critical 5G network function with potential operational impact.

Technical ContextAI

Open5GS is an open-source implementation of 5G core network functions. The vulnerability exists in the NRF (Network Repository Function) component, specifically in the yuarel_parse function within the SBI (Service Based Interface) conversion library. The yuarel_parse function is responsible for parsing URI arguments, and the hnrf-uri parameter is used to specify the NRF URI. The underlying issue relates to CWE-404 (Improper Resource Validation), indicating insufficient validation of the hnrf-uri input before processing. When a maliciously crafted hnrf-uri value is passed to this function, it fails to properly handle the input, leading to a denial of service condition in the NRF component.

RemediationAI

Upgrade Open5GS to a version beyond 2.7.7 once the project releases a patched version. However, the vendor has not responded to early notification and no official patch version has been released at the time of this analysis. As an immediate compensating control, restrict network and API access to the NRF component to only trusted 5G core network functions and management systems - specifically, implement firewall rules or API gateway policies to limit which systems can send requests to the NRF Service Based Interface, particularly filtering requests with complex or unusual hnrf-uri parameter values. Additionally, implement rate limiting and request validation on hnrf-uri inputs at the API gateway level to reject malformed URIs before they reach the NRF parser. Monitor NRF component logs for repeated failures in yuarel_parse or unexpected terminations, and configure alerts to trigger on NRF restarts. These controls reduce availability impact but do not address the root cause; patching is required for complete remediation.