CVE-2026-8249
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk30th percentile - higher than 30% of all known CVEs
Summary
Open5GS up to version 2.7.7 has a vulnerability in the update_authorized_pcc_rule_and_qos function in /src/smf/npcf-handler.c of the SMF component, leading to denial of service (DoS). The attack can be remote. Exploit has been published.
Risk Assessment
An attacker can remotely crash the SMF component, disrupting 5G network operations.
Recommendation
Update Open5GS to a version above 2.7.7 once a patch is released.
Original NVD description (English source)
A flaw has been found in Open5GS up to 2.7.7. The impacted element is the function update_authorized_pcc_rule_and_qos of the file /src/smf/npcf-handler.c of the component SMF. This manipulation causes denial of service. Remote exploitation of the attack is possible. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.