Open5GS EUVD-2026-26680

Q: What is the CVSS score of EUVD-2026-26680?

EUVD-2026-26680 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

| CVE-2026-7586 LOW

Improper Resource Shutdown or Release (CWE-404)

2026-05-01 cna@vuldb.com

Denial Of Service Open5gs

2.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

May 01, 2026 - 16:30 vuln.today

EUVD ID Assigned

May 01, 2026 - 16:22 euvd

EUVD-2026-26680

Analysis Generated

May 01, 2026 - 16:22 vuln.today

CVE Published

May 01, 2026 - 16:16 nvd

LOW 2.1

DescriptionCVE.org

A weakness has been identified in Open5GS up to 2.7.7. Affected is the function ogs_id_get_value of the file /src/amf/nudm-handler.c of the component AMF. This manipulation causes denial of service. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

AnalysisAI

Denial of service in Open5GS up to version 2.7.7 affects the AMF (Access and Mobility Function) component, specifically the ogs_id_get_value function in nudm-handler.c, allowing remote authenticated attackers to cause service unavailability. Publicly available exploit code exists, and the vulnerability has been reported to the project via GitHub issue #4405 without vendor acknowledgment or patch release at time of analysis.

Technical ContextAI

Open5GS is a 5G core network implementation providing AMF (Access and Mobility Function) services for handling subscriber authentication and mobility management. The vulnerability resides in the NUDM (Nudm-UDM handler) component within the AMF, specifically in the ogs_id_get_value function at /src/amf/nudm-handler.c. CWE-404 indicates improper handling of missing resources or incomplete exception handling, suggesting the function fails to properly validate or handle missing or malformed identifier values in NUDM requests. This can trigger abnormal code paths leading to availability impact through resource exhaustion, crashes, or infinite loops within the AMF service.

RemediationAI

No vendor-released patch has been identified at time of analysis. The project has not responded to the issue report (GitHub issue #4405). Recommended mitigations include: immediately upgrade to a version newer than 2.7.7 if released after analysis date; implement network-level access controls restricting NUDM traffic to trusted peer network functions only; monitor AMF service logs for crashes or restart events correlating with NUDM requests containing unusual identifier values; deploy redundant AMF instances with automatic failover to tolerate single-instance denial of service; implement rate limiting on NUDM/UDM interface to reduce impact of repeated exploit attempts. Organizations should subscribe to the Open5GS project repository for security updates and consider reaching out to the maintainers for patch timeline if this affects production deployments.