CVE-2026-8250 Open5GS CVE debrief

Who should care

Users of Open5GS up to version 2.7.7 should be aware of this denial of service vulnerability in the SMF component. They should verify their installations and monitor for vendor patches or updates. Additionally, users should review their network configurations and ensure that they are not exposed to this vulnerability.

Technical summary

The vulnerability affects the smf_n4_build_qos_flow_to_modify_list function in /src/smf/n4-build.c of Open5GS up to 2.7.7. It allows for remote manipulation leading to denial of service. The exploit has been disclosed publicly. Users should verify their installations and monitor for patches. The vulnerability is caused by a flaw in the QoS flow modification list function, which can be exploited remotely to cause a denial of service.

Defensive priority

Medium priority due to low CVSS score of 2.1 and limited details on exploitability. However, given the critical nature of the SMF component, users should prioritize verifying their installations and monitoring for patches.

Recommended defensive actions

• Inventory and verify Open5GS installations up to version 2.7.7
• Monitor for and apply vendor patches or updates when available
• Implement compensating controls to detect and prevent exploitation attempts
• Review and verify Open5GS configurations for potential vulnerabilities
• Track exceptions and retest remediated assets
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

Evidence is limited. Official CVE record and NVD detail provided. Vendor informed but no response yet. The vulnerability affects Open5GS up to 2.7.7. The smf_n4_build_qos_flow_to_modify_list function in /src/smf/n4-build.c can be manipulated remotely to cause a denial of service. Limited details on exploitability are available. Further verification is required to determine the full scope of the vulnerability.

Official resources