Is there a public PoC exploit available for EUVD-2026-29028?

Yes, a public proof-of-concept exploit is available for EUVD-2026-29028. Prioritise patching immediately. EPSS: 0.0%.

Open5GS EUVD-2026-29028

Q: What is the CVSS score of EUVD-2026-29028?

EUVD-2026-29028 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

| CVE-2026-8270 LOW

Improper Resource Shutdown or Release (CWE-404)

2026-05-11 VulDB

GHSA-gmmh-vcqp-grjc

Denial Of Service Open5gs

2.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

May 11, 2026 - 05:30 vuln.today

Severity Changed

May 11, 2026 - 05:22 NVD

MEDIUM LOW

CVSS changed

May 11, 2026 - 05:22 NVD

4.3 (MEDIUM) 2.1 (LOW)

CVE Published

May 11, 2026 - 03:45 nvd

LOW 2.1

DescriptionCVE.org

A vulnerability was determined in Open5GS up to 2.7.7. The affected element is the function ogs_nas_parse_qos_rules of the component SMF. Executing a manipulation can lead to denial of service. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.

AnalysisAI

Denial of service in Open5GS up to version 2.7.7 allows authenticated remote attackers to crash the Session Management Function (SMF) via manipulation of QoS rule parsing in the ogs_nas_parse_qos_rules function. The vulnerability has a low CVSS score of 2.1 but public exploit code is available; however, exploitation requires prior authentication and causes only availability impact without confidentiality or integrity compromise.

Technical ContextAI

Open5GS is an open-source 5G core network implementation. The vulnerability resides in the SMF (Session Management Function) component, specifically in the ogs_nas_parse_qos_rules function which processes Quality of Service (QoS) rule data from NAS (Non-Access Stratum) protocol messages. The root cause is classified as CWE-404 (Improper Resource Validation), indicating that the function fails to properly validate or sanitize QoS rule data before processing, allowing a malformed or oversized payload to trigger a denial of service condition. The attack vector is network-based, targeting the 5G core network's control plane interfaces where authenticated subscribers or access network elements communicate with the SMF.

RemediationAI

No vendor-released patch identified at time of analysis - the Open5GS project acknowledged the issue via GitHub but has not responded with a fix or patched release version. Operators should monitor the official Open5GS GitHub repository (https://github.com/open5gs/open5gs/) for patched version announcements or apply upstream commits that address CWE-404 validation in ogs_nas_parse_qos_rules once released. As interim compensating controls: restrict network access to SMF to only authorized access network elements and authenticated subscribers using firewall rules or network segmentation; implement rate limiting on NAS message processing to reduce denial of service impact; deploy monitoring to detect abnormal QoS rule processing failures and alert operations teams; consider running SMF in a container with automatic restart policies to minimize service downtime if exploitation occurs. Note that these controls mitigate impact but do not eliminate the vulnerability - patching remains the primary remediation once available.