Is there a public PoC exploit available for EUVD-2026-41657?

Yes, a public proof-of-concept exploit is available for EUVD-2026-41657. Prioritise patching immediately. EPSS: 0.3%.

Is there a patch available for EUVD-2026-41657?

Yes, a patch is available for EUVD-2026-41657. Update the affected software to the latest version immediately.

Open5GS EUVD-2026-41657

Q: What is the CVSS score of EUVD-2026-41657?

EUVD-2026-41657 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

| CVE-2026-14618 LOW

Improper Resource Shutdown or Release (CWE-404)

2026-07-04 VulDB

GHSA-8r39-w67j-g66v

Denial Of Service Open5gs N A

2.1

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.1 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

4.3 MEDIUM

Network-reachable SBI interface (AV:N), low-privilege SBI access required (PR:L), no confidentiality or integrity impact, only availability disruption (A:L).

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Jul 04, 2026 - 07:22 NVD

MEDIUM LOW

CVSS changed

Jul 04, 2026 - 07:22 NVD

5.3 (MEDIUM) 2.1 (LOW)

Analysis Generated

Jul 04, 2026 - 06:51 vuln.today

DescriptionCVE.org

A vulnerability was detected in Open5GS up to 2.7.7. Affected by this vulnerability is the function amf_nnrf_handle_nf_discover of the file src/amf/nnrf-handler.c of the component AMF. The manipulation results in denial of service. The attack may be launched remotely. The exploit is now public and may be used. The patch is identified as fb5f67703de0213fb9c6e6ef3b48b6c1707e9503. It is best practice to apply a patch to resolve this issue.

AnalysisAI

Denial of service in the Open5GS AMF component (versions up to 2.7.7) can be triggered remotely by a low-privileged attacker via improper resource handling in the amf_nnrf_handle_nf_discover function of src/amf/nnrf-handler.c. The AMF is a critical 5G core control-plane element; crashing or hanging it disrupts mobility management and NF discovery for all connected UEs and network functions. A public proof-of-concept exists (GitHub issue #4517), and a patch commit has been identified, though the fix originates in a fork rather than the mainline repository.

Technical ContextAI

Open5GS is an open-source implementation of the 3GPP 5G core network stack. The Access and Mobility Management Function (AMF) is a central control-plane node responsible for UE registration, mobility, and session management. It communicates with the Network Repository Function (NRF) via the Nnrf_NFDiscovery service to locate peer network functions. The vulnerable code path, amf_nnrf_handle_nf_discover in src/amf/nnrf-handler.c, processes NF discovery responses from the NRF. CWE-404 (Improper Resource Shutdown or Release) points to a failure to properly close or release a resource - such as a socket, timer, memory allocation, or connection handle - under certain response conditions, likely an unexpected or malformed NRF reply that causes the process to crash or leak into an unrecoverable state. CPE string cpe:2.3:a:n/a:open5gs:*:*:*:*:*:*:*:* reflects that no formal vendor entry exists in the NVD CPE dictionary, consistent with the open-source, community-maintained nature of the project.

RemediationAI

Apply the patch identified as commit fb5f67703de0213fb9c6e6ef3b48b6c1707e9503, currently available in a contributor fork at https://github.com/ferrancanellas/open5gs/commit/fb5f67703de0213fb9c6e6ef3b48b6c1707e9503. Operators should monitor the upstream Open5GS repository (https://github.com/open5gs/open5gs/) for a tagged release incorporating this fix, as the patch has not been independently confirmed as merged into a mainline release version. As a compensating control pending an official release, restrict network access to the AMF SBI interface using firewall or network policy rules to limit exposure to only trusted internal NRF and peer NF endpoints - this reduces the attacker pool from any low-privileged SBI participant to only explicitly whitelisted nodes. Note that this workaround does not eliminate the vulnerability and does not protect against a compromised internal NF. No side effects are expected from network segmentation in standard 5G core deployments where the SBI is already internal-only.