CVE-2026-8223
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk38th percentile - higher than 38% of all known CVEs
Summary
Open5GS up to version 2.7.7 has a vulnerability in the pcf_sess_sbi_discover_and_send function of the sm-policies Endpoint component. Input manipulation can lead to denial of service. The attack is remote, and the exploit is public. The project was notified but has not responded.
Risk Assessment
A remote attacker can crash the Open5GS service, disrupting 5G network operations.
Recommendation
Monitor Open5GS updates and apply the fix when available. Temporarily restrict access to the vulnerable endpoint.
Original NVD description (English source)
A vulnerability was found in Open5GS up to 2.7.7. Affected by this vulnerability is the function pcf_sess_sbi_discover_and_send of the component sm-policies Endpoint. Performing a manipulation results in denial of service. It is possible to initiate the attack remotely. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.