CVE-2026-8121 Overview
CVE-2026-8121 is a denial of service vulnerability affecting Open5GS versions up to 2.7.7. The flaw resides in the ogs_sbi_parse_plmn_list function within the /lib/sbi/conv.c library file, which is part of the Network Slice Selection Function (NSSF) component. An authenticated remote attacker can manipulate input to trigger improper resource handling, leading to service disruption. The exploit details have been publicly disclosed. According to the disclosure, the Open5GS project was notified through an issue report but has not yet responded.
Critical Impact
Remote denial of service against Open5GS NSSF, potentially disrupting 5G core network slicing operations and impacting service availability for connected subscribers.
Affected Products
- Open5GS versions up to and including 2.7.7
- Open5GS NSSF (Network Slice Selection Function) component
- Deployments using the ogs_sbi_parse_plmn_list function in /lib/sbi/conv.c
Discovery Timeline
- 2026-05-08 - CVE-2026-8121 published to NVD
- 2026-05-11 - Last updated in NVD database
Technical Details for CVE-2026-8121
Vulnerability Analysis
The vulnerability resides in the ogs_sbi_parse_plmn_list function located in /lib/sbi/conv.c, a Service-Based Interface (SBI) parsing routine used by the NSSF component. The NSSF is responsible for selecting network slices for User Equipment (UE) within 5G core deployments. When the function processes a Public Land Mobile Network (PLMN) list, improper handling of input data triggers a condition that disrupts service. This vulnerability is classified under [CWE-404] Improper Resource Shutdown or Release, indicating that resources are not properly managed during error conditions or unexpected inputs.
Root Cause
The root cause is improper resource handling within ogs_sbi_parse_plmn_list. When the parser encounters malformed or unexpected PLMN list input, it fails to release or shut down resources correctly. This leads to an unstable state in the NSSF component, causing denial of service. The library file /lib/sbi/conv.c performs conversion and parsing of SBI message payloads exchanged between 5G network functions.
Attack Vector
The attack is conducted remotely over the network and requires low-level privileges to access the SBI interface. An attacker with valid access to a network function communication path sends crafted PLMN list data to the NSSF. Because 5G core network functions typically communicate within trusted service meshes, exposure depends on network segmentation and access controls applied to SBI traffic.
No verified proof-of-concept code is publicly attached to this advisory. Refer to the GitHub Issue #4433 and VulDB Vulnerability #361908 for additional technical context.
Detection Methods for CVE-2026-8121
Indicators of Compromise
- Unexpected crashes or restarts of the Open5GS NSSF process
- Abnormal termination logs referencing ogs_sbi_parse_plmn_list or conv.c
- Service availability gaps in 5G slice selection workflows correlated with SBI traffic spikes
Detection Strategies
- Monitor NSSF process health and restart counters across the 5G core deployment
- Inspect SBI HTTP/2 traffic for malformed PLMN list payloads sent to NSSF endpoints
- Correlate NSSF service interruptions with originating network function identifiers in audit logs
Monitoring Recommendations
- Enable verbose logging in Open5GS NSSF to capture parser-level errors and stack traces
- Track SBI request rates per source to identify anomalous senders targeting NSSF
- Implement alerting on repeated NSSF service restarts within short time windows
How to Mitigate CVE-2026-8121
Immediate Actions Required
- Restrict network access to the NSSF SBI interface to authorized 5G network functions only
- Apply strict authentication and mutual TLS on all SBI communications
- Monitor the Open5GS GitHub repository for an upstream patch addressing this issue
Patch Information
As of the latest update, the Open5GS project has not yet responded to the disclosed issue report tracked in GitHub Issue #4433. No official patch has been released for versions up to 2.7.7. Operators should track the upstream repository for a fix and plan an upgrade window once a patched release becomes available.
Workarounds
- Deploy SBI-aware traffic filtering or service mesh policies to block unexpected PLMN list payloads to NSSF
- Isolate the NSSF component within a dedicated network segment with allowlisted peer network functions
- Implement watchdog supervision to automatically restart the NSSF process and minimize downtime if the parser fails
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
