Is there a public PoC exploit available for EUVD-2026-29052?

Yes, a public proof-of-concept exploit is available for EUVD-2026-29052. Prioritise patching immediately. EPSS: 0.0%.

Open5GS EUVD-2026-29052

Q: What is the CVSS score of EUVD-2026-29052?

EUVD-2026-29052 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

| CVE-2026-8289 LOW

Improper Resource Shutdown or Release (CWE-404)

2026-05-11 VulDB

GHSA-f67v-6p73-pvc5

Denial Of Service Open5gs

2.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

May 11, 2026 - 14:22 NVD

MEDIUM LOW

CVSS changed

May 11, 2026 - 14:22 NVD

4.3 (MEDIUM) 2.1 (LOW)

Analysis Generated

May 11, 2026 - 13:45 vuln.today

CVE Published

May 11, 2026 - 12:30 nvd

MEDIUM 4.3

DescriptionCVE.org

A vulnerability was identified in Open5GS up to 2.7.7. This vulnerability affects the function smf_nsmf_handle_update_data_in_vsmf of the file /src/smf/nsmf-handler.c of the component SMF. The manipulation of the argument qosFlowProfile leads to denial of service. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.

AnalysisAI

Denial of service in Open5GS up to version 2.7.7 allows authenticated remote attackers to crash the Session Management Function (SMF) by manipulating the qosFlowProfile argument in the smf_nsmf_handle_update_data_in_vsmf function. Publicly available exploit code exists, and the vulnerability affects the 5G core network's ability to manage quality-of-service parameters, though the project maintainers have not yet responded to early disclosure.

Technical ContextAI

Open5GS is an open-source implementation of 5G Core and EPC (Evolved Packet Core). The vulnerability resides in the SMF (Session Management Function) component, specifically in the nsmf-handler.c file's smf_nsmf_handle_update_data_in_vsmf function. This function processes incoming N11 interface messages related to session data updates, including quality-of-service profile configurations. The CWE-404 classification (Improper Resource Validation) indicates the root cause is insufficient validation or bounds checking of the qosFlowProfile parameter before it is processed, allowing malformed or oversized input to trigger an unhandled exception or resource exhaustion condition that crashes the SMF process.

RemediationAI

Upgrade Open5GS to a patched version once available from the project repository (https://github.com/open5gs/open5gs/); monitor GitHub issue #4453 for resolution status and release announcements. Until patching is available, implement network-level mitigation by restricting N11 interface access to explicitly trusted network functions only, using firewall rules or service mesh policies to limit which systems can send NSMF messages to the SMF component. Additionally, implement SMF process monitoring and automatic restart mechanisms (e.g., systemd service restart on crash) to reduce downtime from denial-of-service triggers, though this does not prevent the attack. Rate-limit or validate incoming NSMF update messages at an upstream API gateway if present in the architecture, flagging or dropping requests with suspiciously malformed qosFlowProfile structures. Trade-off: rate-limiting may cause legitimate QoS update delays; process restart masks the vulnerability but does not eliminate it.