Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.8

Open5GS can be crashed by remote delete request

CVE-2026-8225 · published 5 months ago
Summary

The Open5GS mobile‑network software (versions up to 2.7.7) allows a specially crafted delete request to cause the system to stop responding. An attacker on the network can trigger this without needing credentials, leading to a denial of service. Apply the latest Open5GS update or patch the affected file to prevent the crash.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
open5gs open5gs <= 2.7.7
cpe:2.3:a:open5gs:open5gs:*:*:*:*:*:*:*:*
Original advisory text
Open5GS delete Endpoint sm-sm.c pcf_npcf_smpolicycontrol_handle_delete denial of service
A vulnerability was identified in Open5GS up to 2.7.7. This affects the function pcf_npcf_smpolicycontrol_handle_delete of the file src/pcf/sm-sm.c of the component delete Endpoint. The manipulation leads to denial of service. The attack can be initiated remotely. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker partial control
Severity
7.8 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-404Improper Resource Shutdown or Release
Timeline
Published10 May 2026
Updated4 Nov 2026
First seen10 May 2026
Sources
CVE-2026-8225 · NVD
CVE-2026-8225 · OSV
Track software like this
Free during beta