Is there a public PoC exploit available for EUVD-2026-29003?

Yes, a public proof-of-concept exploit is available for EUVD-2026-29003. Prioritise patching immediately. EPSS: 0.0%.

Open5GS EUVD-2026-29003

Q: What is the CVSS score of EUVD-2026-29003?

EUVD-2026-29003 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

| CVE-2026-8249 LOW

Improper Resource Shutdown or Release (CWE-404)

2026-05-10 VulDB

GHSA-qhrx-45m5-grgp

Denial Of Service Open5gs

2.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

May 10, 2026 - 23:22 NVD

MEDIUM LOW

CVSS changed

May 10, 2026 - 23:22 NVD

4.3 (MEDIUM) 2.1 (LOW)

Analysis Generated

May 10, 2026 - 23:15 vuln.today

CVE Published

May 10, 2026 - 22:30 nvd

MEDIUM 4.3

DescriptionCVE.org

A flaw has been found in Open5GS up to 2.7.7. The impacted element is the function update_authorized_pcc_rule_and_qos of the file /src/smf/npcf-handler.c of the component SMF. This manipulation causes denial of service. Remote exploitation of the attack is possible. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.

AnalysisAI

Denial of service vulnerability in Open5GS up to version 2.7.7 allows authenticated remote attackers to crash the Service Measurement Function (SMF) component via improper handling in the update_authorized_pcc_rule_and_qos function. The vulnerability has a publicly available exploit and moderate CVSS score (4.3) but is limited to authenticated access and results in availability impact only. The vendor has not yet released a patch despite early notification through a GitHub issue.

Technical ContextAI

Open5GS is an open-source implementation of 5G and LTE core network functions. The vulnerability exists in the SMF (Service Measurement Function) component, specifically in the npcf-handler.c file's update_authorized_pcc_rule_and_qos function. This function is responsible for updating authorized PCC (Policy and Charging Control) rules and QoS parameters as part of the Npcf (Network Policy Control Function) signaling interface. CWE-404 (Improper Resource Validation) indicates the root cause involves improper validation or handling of resources, likely related to malformed PCC rule updates or QoS parameter handling that fails gracefully, resulting in process termination or resource exhaustion within the SMF service.

RemediationAI

No vendor-released patch has been identified at time of analysis; the project has not yet responded to the early issue notification. Until a patched version is released, operators should implement the following compensating controls: restrict SMF access via network-level authentication and authorization rules to limit attacker eligibility (only legitimate core network components should communicate with SMF), enable rate limiting and connection pooling on Npcf interface endpoints to reduce the impact of malformed PCC rule updates, monitor SMF process restarts and crashes via logging and alerting systems to detect exploitation attempts, and consider running SMF in a containerized environment with automatic restart policies to reduce downtime. Operators should actively monitor the Open5GS GitHub repository (https://github.com/open5gs/open5gs/) and VulDB (https://vuldb.com/vuln/362546) for patch availability and upgrade immediately when a fixed version is released. Filtering of malformed Npcf messages at the network edge may provide limited mitigation but risks blocking legitimate signaling.