Is there a public PoC exploit available for CVE-2026-8745?

Yes, a public proof-of-concept exploit is available for CVE-2026-8745. Prioritise patching immediately. EPSS: 0.0%.

Open5GS CVE-2026-8745

Q: What is the CVSS score of CVE-2026-8745?

CVE-2026-8745 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-30693 LOW

Improper Resource Shutdown or Release (CWE-404)

2026-05-17 VulDB

GHSA-2wq5-j34g-97x4

Denial Of Service Open5gs

2.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

May 17, 2026 - 10:30 vuln.today

Severity Changed

May 17, 2026 - 10:22 NVD

MEDIUM LOW

CVSS changed

May 17, 2026 - 10:22 NVD

4.3 (MEDIUM) 2.1 (LOW)

DescriptionCVE.org

A vulnerability was identified in Open5GS up to 2.7.7. Affected by this vulnerability is the function ogs_timer_add in the library /src/ausf/nausf-handler.c of the component AUSF. The manipulation leads to denial of service. The attack can be initiated remotely. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.

AnalysisAI

Remote authenticated denial of service in Open5GS versions up to 2.7.7 allows attackers to crash the AUSF (Authentication Server Function) component via crafted timer manipulation. The vulnerability resides in ogs_timer_add function within nausf-handler.c. Public exploit code exists via GitHub issue #4472, though vendor has not responded to disclosure. EPSS data unavailable; CVSS 4.0 scores only 2.1 due to low availability impact and authenticated requirement, but the existence of public exploit elevates practical risk for exposed 5G core deployments.

Technical ContextAI

Open5GS is an open-source implementation of 5G core network components including the AUSF (Authentication Server Function), which handles subscriber authentication in 5G networks. The vulnerability affects the ogs_timer_add function in /src/ausf/nausf-handler.c - a timer management routine within the AUSF service. CWE-404 (Improper Resource Shutdown or Release) indicates the flaw involves failure to correctly clean up or manage timer resources, likely causing resource exhaustion or null pointer dereferences when timers are added under specific conditions. The AUSF component processes authentication requests from network functions, making this a critical point in the 5G authentication flow. Exploitation targets the network-accessible API of the AUSF service, which processes authentication protocols like 5G-AKA.

RemediationAI

No vendor-released patch identified at time of analysis despite early disclosure through GitHub issue #4472 (https://github.com/open5gs/open5gs/issues/4472). Operators should monitor the Open5GS GitHub repository for security updates addressing CVE-2026-8745. Compensating controls for production deployments: (1) Restrict network access to AUSF service interfaces using firewall rules to allow only trusted 5G core network functions - mitigates remote attack vector but may break roaming scenarios. (2) Implement rate limiting on AUSF authentication requests at ingress points to slow resource exhaustion attacks - reduces impact but does not prevent crash. (3) Deploy AUSF redundancy with automatic failover to maintain service availability during DoS events - operational complexity increases. (4) Enable detailed logging and monitoring for ogs_timer_add failures to detect exploitation attempts. Consider downgrading to earlier stable versions only if version 2.7.7 introduced the regression, though this carries other security risks. Contact Open5GS maintainers directly through GitHub or mailing lists to request patch timeline.