CVE-2026-8119: Open5GS NSSF Component DoS Vulnerability

CVE-2026-8119 Overview

CVE-2026-8119 affects Open5GS versions up to 2.7.7, an open-source implementation of 5G Core and EPC networks. The vulnerability resides in the ogs_sbi_stream_find_by_id function within /lib/sbi/nghttp2-server.c, a component of the Network Slice Selection Function (NSSF). An attacker with local access and low privileges can manipulate the function to trigger a denial of service condition. The flaw is categorized under [CWE-404] (Improper Resource Shutdown or Release). Public exploit details exist, though the Open5GS project has not yet responded to the initial issue report.

Critical Impact
Local attackers with low privileges can crash or disrupt the NSSF component of Open5GS, impacting 5G core network slice selection availability.

Affected Products

Open5GS versions up to and including 2.7.7
Open5GS NSSF component (/lib/sbi/nghttp2-server.c)
Deployments using ogs_sbi_stream_find_by_id in the SBI library

Discovery Timeline

2026-05-08 - CVE-2026-8119 published to NVD
2026-05-11 - Last updated in NVD database

Technical Details for CVE-2026-8119

Vulnerability Analysis

The vulnerability resides in ogs_sbi_stream_find_by_id, a function in the Service-Based Interface (SBI) library that locates HTTP/2 streams by identifier. The function operates within the nghttp2-server.c source file used by the NSSF component. Improper resource handling during stream lookup allows an attacker with local access to send manipulated input that disrupts the NSSF service.

The NSSF is a core component in 5G Service-Based Architecture (SBA). It selects Network Slice instances for User Equipment (UE) requests. Disrupting NSSF availability degrades slice selection across the 5G core, affecting subscriber service continuity.

Root Cause

The root cause maps to [CWE-404] Improper Resource Shutdown or Release. The ogs_sbi_stream_find_by_id function does not correctly manage stream resource state during lookup operations. Manipulated input causes the function to fail in a way that leads to a denial of service rather than a controlled error path.

Attack Vector

The attack vector is local, requiring the attacker to have low-privilege access on the host running Open5GS. No user interaction is required. The attacker submits a crafted request that exercises the vulnerable code path in the NSSF's HTTP/2 server handler. The vulnerability does not enable confidentiality or integrity impact, only availability degradation on the affected component.

No verified proof-of-concept code is available in the public references. For technical context, review the GitHub Open5GS Issue #4431 and the VulDB Vulnerability #361906 entries.

Detection Methods for CVE-2026-8119

Indicators of Compromise

Unexpected crashes or restarts of the Open5GS NSSF process on hosts running versions up to 2.7.7
Abnormal HTTP/2 stream termination events in NSSF logs originating from local clients
Repeated SBI request failures correlating with degraded slice selection performance

Detection Strategies

Monitor Open5GS NSSF process health and restart counts using host-level telemetry
Inspect SBI HTTP/2 server logs for malformed stream identifiers and lookup failures in ogs_sbi_stream_find_by_id
Correlate local user session activity with NSSF service disruption events to identify low-privilege actors triggering the condition

Monitoring Recommendations

Enable verbose logging for the Open5GS SBI library during incident response and baseline normal stream lookup patterns
Track availability metrics for the NSSF endpoint and alert on deviations
Audit local user accounts with shell or service access on Open5GS hosts and review access patterns

How to Mitigate CVE-2026-8119

Immediate Actions Required

Inventory all Open5GS deployments and identify hosts running versions at or below 2.7.7
Restrict local access to Open5GS hosts to authorized operators only and remove unused local accounts
Monitor the Open5GS GitHub repository for an upstream fix addressing issue #4431

Patch Information

At the time of publication, the Open5GS project has not released a patch addressing CVE-2026-8119. The vendor was notified through an issue report but has not responded. Operators should track the GitHub Open5GS Issue #4431 for status updates and apply the official fix once available.

Workarounds

Apply strict host-level access controls and limit shell access on systems running the NSSF component
Run Open5GS components under dedicated, unprivileged service accounts to limit lateral exposure
Deploy process supervision (for example, systemd with automatic restart) to reduce downtime if the NSSF crashes
Network-segment the 5G core so only trusted management hosts can reach the SBI interfaces

bash

# Example: restrict local access and enable automatic restart for NSSF
sudo systemctl edit open5gs-nssfd
# Add the following override:
# [Service]
# Restart=always
# RestartSec=5
sudo systemctl daemon-reload
sudo systemctl restart open5gs-nssfd