Open5GS CVE-2026-8731

No vendor-released patch identified at time of analysis - upstream project has not responded to the disclosure in GitHub issue #4464. Primary mitigation: Monitor https://github.com/open5gs/open5gs/ for security patches and upgrade immediately when available. Interim compensating controls require defense-in-depth approach: (1) Restrict NRF access to only authorized network functions using mutual TLS authentication and IP allowlisting - this limits the attack surface to compromised legitimate clients. (2) Implement rate limiting and request validation on NRF SBI endpoints to detect/block malformed client_pool manipulations - may cause false positives if legitimate clients send unexpected parameters. (3) Deploy NRF instances in high-availability configuration with health monitoring to automatically restart crashed instances - reduces downtime but does not prevent exploitation. (4) Enable detailed NRF logging to detect exploitation attempts via anomalous client registration patterns - generates significant log volume in large deployments. (5) Consider network segmentation to isolate NRF from untrusted network functions - may complicate service discovery architecture. Trade-offs: These controls reduce exploitability but do not eliminate the underlying vulnerability; authentication bypass or credential compromise negates most mitigations. For production 5G deployments, evaluate alternative 5G core solutions or defer Open5GS upgrades to non-vulnerable versions once available.