CVE-2026-8251 Open5GS CVE debrief

Who should care

Users of Open5GS up to version 2.7.7 should be aware of this denial of service vulnerability and take steps to mitigate it. This includes verifying affected Open5GS installations, applying vendor patches or updates when available, monitoring for suspicious activity, and implementing compensating controls to limit exposure.

Technical summary

The vulnerability is located in the SMF component of Open5GS, specifically in the update_authorized_pcc_rule_and_qos function of the /src/smf/npcf-handler.c file. A remote attacker can exploit this vulnerability to cause a denial of service. The vulnerability was found in Open5GS up to 2.7.7. Users of Open5GS up to version 2.7.7 should be aware of this denial of service vulnerability and take steps to mitigate it. This includes verifying affected Open5GS installations, applying vendor patches or updates when available, monitoring for suspicious activity, and implementing compensating controls to limit exposure. The project was informed of the problem early through an issue report but has not responded yet.

Defensive priority

Low

Recommended defensive actions

• Inventory and verify affected Open5GS installations
• Apply vendor patches or updates when available
• Monitor for suspicious activity
• Implement compensating controls to limit exposure
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record was published on 2026-05-10T23:16:27.563Z and was last modified on 2026-07-24T07:10:00.200Z. The NVD entry is currently Analyzed. The vulnerability was found in Open5GS up to 2.7.7, which impacts the function update_authorized_pcc_rule_and_qos of the file /src/smf/npcf-handler.c of the component SMF. Performing a manipulation results in denial of service. The attack is possible to be carried out remotely. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.

Official resources