CVE-2026-8266
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk37th percentile - higher than 37% of all known CVEs
Summary
In Open5GS up to version 2.7.7, a vulnerability in the gsm_build_pdu_session_establishment_accept function of the SMF component allows manipulation leading to denial of service (DoS). The attack can be launched remotely, and the exploit is publicly available.
Risk Assessment
The organization is at risk of remote disruption of 5G network services, potentially affecting communication and system availability.
Recommendation
Update Open5GS to the latest version or apply temporary network mitigations to block access to the vulnerable endpoint.
Original NVD description (English source)
A vulnerability was detected in Open5GS up to 2.7.7. This affects the function gsm_build_pdu_session_establishment_accept of the file /src/smf/gsm-build.c of the component SMF. The manipulation results in denial of service. The attack can be launched remotely. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet.