CVE-2026-8222
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk38th percentile - higher than 38% of all known CVEs
Summary
Open5GS up to version 2.7.7 has a vulnerability in the pcf_nbsf_management_handle_register function in src/pcf/nbsf-handler.c of the sm-policies Endpoint component. Input manipulation leads to denial of service. The attack is remote, and the exploit is public. The project was notified but has not responded.
Risk Assessment
A remote attacker can crash the Open5GS service, disrupting 5G network operations.
Recommendation
Monitor Open5GS updates and apply the fix when available. Temporarily restrict access to the vulnerable endpoint.
Original NVD description (English source)
A vulnerability has been found in Open5GS up to 2.7.7. Affected is the function pcf_nbsf_management_handle_register of the file src/pcf/nbsf-handler.c of the component sm-policies Endpoint. Such manipulation leads to denial of service. The attack may be performed from remote. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet.