CVE-2026-8250
Open5GS SMF Denial of Service Vulnerability
Publication date: 2026-05-10
Last updated on: 2026-05-10
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| open5gs | open5gs | to 2.7.7 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-404 | The product does not release or incorrectly releases a resource before it is made available for re-use. |
Attack-Flow Graph
AI Powered Q&A
How can this vulnerability impact me? :
The vulnerability can be exploited remotely to cause a denial of service, potentially disrupting the normal operation of the affected Open5GS system.
Can you explain this vulnerability to me?
This vulnerability exists in Open5GS up to version 2.7.7, specifically in the function smf_n4_build_qos_flow_to_modify_list within the SMF component. It allows an attacker to manipulate this function remotely, which leads to a denial of service condition.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The provided information does not specify any direct impact of the CVE-2026-8250 vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by monitoring for crashes or abnormal termination of the SMF process in Open5GS, especially exit code 139 which indicates a segmentation fault caused by processing an oversized flowInfos list.
Detection can also involve inspecting network traffic for suspicious POST requests to the endpoint /nsmf-callback/v1/sm-policy-notify/{smContextRef}/update containing an unusually large number of flowInfos elements (more than 15).
A practical approach is to check SMF logs for crash events and to capture and analyze HTTP POST requests to the specified endpoint.
- Use system commands like `journalctl -u open5gs-smfd` or `ps` and `dmesg` to detect SMF crashes or segmentation faults.
- Use network capture tools such as `tcpdump` or `wireshark` to filter and analyze POST requests to `/nsmf-callback/v1/sm-policy-notify/`.
- Example tcpdump command: `tcpdump -i <interface> -A 'tcp port 80 and (((ip[2:2] - ((ip[0]&0xf)<<2)) - ((tcp[12]&0xf0)>>2)) != 0)'` and then filter HTTP POST requests to the vulnerable endpoint.
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation involves preventing the SMF from processing oversized flowInfos lists that exceed the limit of 15 entries.
Since the vulnerability causes a denial of service by crashing the SMF process, you should monitor and restrict incoming POST requests to the vulnerable endpoint to ensure they do not contain more than 15 flowInfos elements.
If possible, apply input validation or filtering at the network or application level to reject requests with excessive flowInfos before they reach the SMF.
Additionally, consider temporarily disabling or restricting access to the /nsmf-callback/v1/sm-policy-notify/{smContextRef}/update endpoint until a patch or official fix is released.
Monitor SMF logs for crashes and restart the service as needed to maintain availability.