Is there a public PoC exploit available for CVE-2026-8729?

Yes, a public proof-of-concept exploit is available for CVE-2026-8729. Prioritise patching immediately. EPSS: 0.1%.

Open5GS CVE-2026-8729

Q: What is the CVSS score of CVE-2026-8729?

CVE-2026-8729 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-30679 LOW

Improper Resource Shutdown or Release (CWE-404)

2026-05-17 VulDB

GHSA-4r7x-pm54-qxq9

Denial Of Service Open5gs

2.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

May 17, 2026 - 05:22 NVD

MEDIUM LOW

CVSS changed

May 17, 2026 - 05:22 NVD

4.3 (MEDIUM) 2.1 (LOW)

Analysis Generated

May 17, 2026 - 05:13 vuln.today

DescriptionCVE.org

A vulnerability was detected in Open5GS up to 2.7.7. This affects an unknown function in the library /lib/sbi/message.c of the component NRF. Performing a manipulation of the argument service-names/snssais results in denial of service. The attack is possible to be carried out remotely. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet.

AnalysisAI

Denial of service in Open5GS versions up to 2.7.7 allows authenticated remote attackers to crash the Network Repository Function (NRF) component by manipulating service-names or snssais parameters in SBI messages. A public proof-of-concept exploit exists via GitHub issue #4460, and the vendor has not responded to the early disclosure. EPSS data unavailable, but the low CVSS 4.3 score reflects limited impact (availability only, authenticated access required), reducing real-world urgency for most deployments.

Technical ContextAI

Open5GS is an open-source implementation of 5G core network functions used in telecommunications infrastructure. The vulnerability resides in the Service-Based Interface (SBI) message handling code within /lib/sbi/message.c, specifically affecting the Network Repository Function (NRF) - a critical 5G control plane component responsible for service discovery and registration. The NRF processes service-names and slice identifiers (S-NSSAIs, Single Network Slice Selection Assistance Information) from other network functions. CWE-404 (Improper Resource Shutdown or Release) indicates the flaw causes incomplete cleanup or state corruption when processing malformed service registration data, leading to resource exhaustion or crash conditions. The SBI protocol is HTTP/2-based, exposing the vulnerability to network-layer attacks from other authenticated 5G network components.

RemediationAI

No vendor-released patch is confirmed at time of analysis despite early responsible disclosure via GitHub issue. Monitor the upstream repository at https://github.com/open5gs/open5gs/ for commits addressing /lib/sbi/message.c parsing logic related to issue #4460. Until a patch is available, implement strict authentication controls for all SBI interfaces to the NRF component, limiting access to only verified and trusted 5G network functions using mutual TLS and certificate pinning. Deploy input validation proxies or API gateways in front of NRF endpoints to filter malformed service-names and S-NSSAI parameters before they reach the vulnerable parsing code - this adds latency but prevents exploitation. Network segmentation should isolate NRF instances from untrusted network functions, with firewall rules restricting SBI access to whitelisted IP ranges only. For high-availability deployments, configure NRF redundancy with health monitoring to automatically fail over if a denial-of-service condition is triggered. Review authentication logs for unusual service registration attempts targeting the vulnerable parameters. Note that input filtering may break legitimate edge-case service registrations if validation rules are too strict - test thoroughly in non-production environments first.