CVE-2026-8268
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk30th percentile - higher than 30% of all known CVEs
Summary
Open5GS up to version 2.7.7 has a vulnerability in the OpenAPI_list_create function of the SMF component, leading to denial of service (DoS). The attack can be remote. Exploit has been disclosed.
Risk Assessment
An attacker can remotely crash the SMF component, disrupting 5G network operations.
Recommendation
Update Open5GS to a version above 2.7.7 once a patch is released.
Original NVD description (English source)
A vulnerability has been found in Open5GS up to 2.7.7. This issue affects the function OpenAPI_list_create of the component SMF. Such manipulation leads to denial of service. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet.