Is there a public PoC exploit available for CVE-2026-8746?

Yes, a public proof-of-concept exploit is available for CVE-2026-8746. Prioritise patching immediately. EPSS: 0.0%.

Open5GS CVE-2026-8746

Q: What is the CVSS score of CVE-2026-8746?

CVE-2026-8746 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-30695 LOW

Use After Free (CWE-416)

2026-05-17 VulDB

GHSA-49g8-77wh-w2gp

Denial Of Service Use After Free Memory Corruption Open5gs

2.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

May 17, 2026 - 11:22 NVD

MEDIUM LOW

CVSS changed

May 17, 2026 - 11:22 NVD

4.3 (MEDIUM) 2.1 (LOW)

Analysis Generated

May 17, 2026 - 11:01 vuln.today

DescriptionCVE.org

A security flaw has been discovered in Open5GS up to 2.7.7. Affected by this issue is the function discover_handler in the library /lib/sbi/nghttp2-server.c of the component NRF. The manipulation results in use after free. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

AnalysisAI

Use-after-free vulnerability in Open5GS NRF component (versions up to 2.7.7) allows authenticated remote attackers to trigger denial of service via the discover_handler function in nghttp2-server.c. Publicly available exploit code exists (GitHub issue #4476), but vendor has not responded to early disclosure. EPSS data not available; CVSS 4.3 (Medium) reflects limited scope (DoS only, authenticated access required). Not listed in CISA KEV, indicating no confirmed widespread exploitation despite public POC.

Technical ContextAI

Open5GS is an open-source implementation of 5G Core and EPC (Evolved Packet Core) network functions. The vulnerability resides in the Network Repository Function (NRF), a critical 5G service discovery component that maintains profiles of available network functions. The flaw occurs in discover_handler within nghttp2-server.c, the HTTP/2 server library handling Service-Based Interface (SBI) communications between 5G network functions. CWE-416 (Use After Free) indicates memory is accessed after being freed, a classic memory corruption issue in C/C++ code. The nghttp2 library manages persistent HTTP/2 connections for NRF service discovery requests, making memory lifecycle management critical. Affected product confirmed via CPE: Open5GS versions through 2.7.7.

RemediationAI

No vendor-released patch identified at time of analysis - Open5GS project has not responded to vulnerability disclosure (CVSS RL:X). Primary recommendation: Monitor GitHub repository https://github.com/open5gs/open5gs/ for patches addressing issue #4476. Interim compensating controls: (1) Restrict network access to NRF SBI endpoints (default TCP 7777) to authenticated network functions only via firewall rules or network segmentation - blocks external attackers but does not prevent exploitation by compromised internal NFs. (2) Implement request rate limiting on NRF discover_handler endpoints to mitigate DoS impact - reduces attack effectiveness but does not eliminate use-after-free condition. (3) Deploy intrusion detection signatures for malformed service discovery requests targeting nghttp2-server.c - provides detection but not prevention. (4) Consider temporarily disabling non-essential NRF service discovery features if operationally feasible - significant operational impact on dynamic network function registration. (5) For non-production environments, evaluate alternative 5G core implementations until patch available. All mitigations have limitations; authenticated attacker with valid network function credentials can still trigger vulnerability. Advisory references: VulDB CTI https://vuldb.com/vuln/364333/cti and exploit details https://github.com/open5gs/open5gs/issues/4476.