CVE-2026-8250
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk30th percentile - higher than 30% of all known CVEs
Summary
Open5GS up to version 2.7.7 has a vulnerability in the smf_n4_build_qos_flow_to_modify_list function in /src/smf/n4-build.c of the SMF component, leading to denial of service (DoS). The attack can be remote. Exploit has been disclosed.
Risk Assessment
An attacker can remotely crash the SMF component, disrupting 5G network operations.
Recommendation
Update Open5GS to a version above 2.7.7 once a patch is released.
Original NVD description (English source)
A vulnerability has been found in Open5GS up to 2.7.7. This affects the function smf_n4_build_qos_flow_to_modify_list of the file /src/smf/n4-build.c of the component SMF. Such manipulation leads to denial of service. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet.