CVE-2026-8225
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk39th percentile - higher than 39% of all known CVEs
Summary
A vulnerability was discovered in Open5GS up to version 2.7.7 in the function pcf_npcf_smpolicycontrol_handle_delete in the file src/pcf/sm-sm.c in the delete Endpoint component. Manipulation leads to denial of service. The attack can be launched remotely. The exploit is publicly available.
Risk Assessment
An attacker can remotely cause a denial of service, potentially disrupting 5G network operations using Open5GS.
Recommendation
Upgrade Open5GS to a patched version or apply temporary network restrictions to block access to the vulnerable endpoint.
Original NVD description (English source)
A vulnerability was identified in Open5GS up to 2.7.7. This affects the function pcf_npcf_smpolicycontrol_handle_delete of the file src/pcf/sm-sm.c of the component delete Endpoint. The manipulation leads to denial of service. The attack can be initiated remotely. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.