Is there a public PoC exploit available for EUVD-2026-29004?

Yes, a public proof-of-concept exploit is available for EUVD-2026-29004. Prioritise patching immediately. EPSS: 0.0%.

Open5GS EUVD-2026-29004

Q: What is the CVSS score of EUVD-2026-29004?

EUVD-2026-29004 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

| CVE-2026-8250 LOW

Improper Resource Shutdown or Release (CWE-404)

2026-05-10 VulDB

GHSA-pwcx-2r94-w92m

Denial Of Service Open5gs

2.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

May 10, 2026 - 23:22 NVD

MEDIUM LOW

CVSS changed

May 10, 2026 - 23:22 NVD

4.3 (MEDIUM) 2.1 (LOW)

Analysis Generated

May 10, 2026 - 23:15 vuln.today

CVE Published

May 10, 2026 - 22:45 nvd

MEDIUM 4.3

DescriptionCVE.org

A vulnerability has been found in Open5GS up to 2.7.7. This affects the function smf_n4_build_qos_flow_to_modify_list of the file /src/smf/n4-build.c of the component SMF. Such manipulation leads to denial of service. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet.

AnalysisAI

Denial of service in Open5GS up to version 2.7.7 via the smf_n4_build_qos_flow_to_modify_list function in the SMF (Session Management Function) component allows remote authenticated attackers to crash the service with low attack complexity. The vulnerability has been publicly disclosed with exploit code available; the vendor was notified early but has not yet released a fix.

Technical ContextAI

Open5GS is a 5G core network implementation. The vulnerability exists in the Session Management Function (SMF) component, specifically in the N4 protocol message builder (n4-build.c). The smf_n4_build_qos_flow_to_modify_list function handles Quality of Service flow modification lists used in 5G session management. CWE-404 (Improper Resource Validation) indicates the underlying issue is a failure to properly validate or handle resource manipulation during QoS flow list construction, likely leading to an unchecked operation that causes memory corruption, resource exhaustion, or null pointer dereference when processing specially crafted N4 protocol messages.

RemediationAI

No vendor-released patch has been identified at the time of analysis despite early disclosure to the project. Immediate remediation options are limited: (1) Upgrade to a newer version beyond 2.7.7 if available from the Open5GS project (verify at https://github.com/open5gs/open5gs/releases), though the vendor's lack of response raises questions about release timeline. (2) Implement network-level access controls to restrict which peers or systems can reach the SMF N4 interface, reducing the authenticated attacker surface. (3) Deploy SMF instances behind a dedicated load balancer with health checks and automatic failover to mitigate denial-of-service impact on availability. (4) Monitor N4 protocol traffic for malformed QoS flow modification messages and rate-limit requests from suspicious sources. (5) Contact the Open5GS project directly via https://github.com/open5gs/open5gs/issues to request an update or workaround. These compensating controls do not eliminate the vulnerability but reduce blast radius and detection time.