PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-8266 Open5GS CVE debrief

A vulnerability was detected in Open5GS up to 2.7.7, affecting the SMF component's gsm_build_pdu_session_establishment_accept function in /src/smf/gsm-build.c. The manipulation results in denial of service. The attack can be launched remotely. Users should review official advisories and CVE records for affected scope, severity, and vendor guidance. This issue has a low CVSS score of 2.1, indicating a low severity vulnerability.

Vendor
Open5GS
Product
Open5GS
CVSS
LOW 2.1
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-11
Original CVE updated
2026-07-23
Advisory published
2026-05-11
Advisory updated
2026-07-23

Who should care

Users of Open5GS up to version 2.7.7, particularly those with SMF component deployments, should be aware of this denial of service vulnerability. They should review official advisories, assess exposure, and plan vendor-supported updates or mitigations. Additionally, security teams and operators managing Open5GS installations should prioritize reviewing and addressing this vulnerability.

Technical summary

The vulnerability is located in the gsm_build_pdu_session_establishment_accept function within the /src/smf/gsm-build.c file of the Open5GS SMF component. This issue allows for a denial of service attack that can be launched remotely. Affected product deployments should be reviewed for exposure, and compensating controls may be necessary. The vulnerability affects Open5GS up to version 2.7.7, specifically the SMF component.

Defensive priority

Medium priority due to the low CVSS score of 2.1 and the need for remote access and low privileges to exploit. However, given the potential impact on service availability, it is essential to address this vulnerability in a timely manner.

Recommended defensive actions

  • Inventory and verify affected Open5GS installations
  • Apply vendor patches or updates when available
  • Monitor for unusual activity in SMF component
  • Implement compensating controls to limit exposure
  • Review official advisories for affected scope and severity
  • Track exceptions and retest remediated assets
  • Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record was published on 2026-05-11T04:16:20.060Z and was last modified on 2026-07-23T20:10:00.130Z. The NVD entry is currently Analyzed. The vulnerability affects Open5GS up to version 2.7.7, specifically the SMF component. Evidence of exploitation is not publicly available, but defenders should verify affected scope and vendor guidance. The project was informed of the problem early through an issue report but has not responded yet.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-8266 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-8266

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-8266 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-8266

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.