CVE-2026-8223: Open5GS DoS Vulnerability in sm-policies

CVE-2026-8223 Overview

CVE-2026-8223 is a denial-of-service vulnerability in Open5GS versions up to 2.7.7. The flaw resides in the pcf_sess_sbi_discover_and_send function within the sm-policies endpoint of the Policy Control Function (PCF) component. A remote attacker can trigger the issue without authentication or user interaction, disrupting availability of the affected 5G core service. Public exploit details have been released, and the upstream project has not yet responded to the issue report. Open5GS is widely deployed for research, testbed, and production 5G/LTE core networks, making availability impact a concern for telecom and lab operators.

Critical Impact
Remote, unauthenticated attackers can disrupt PCF session policy handling in Open5GS, degrading 5G core availability through the public sm-policies endpoint.

Affected Products

Open5GS versions up to and including 2.7.7
Open5GS Policy Control Function (PCF) component
Deployments exposing the sm-policies SBI endpoint

Discovery Timeline

2026-05-10 - CVE-2026-8223 published to NVD
2026-05-13 - Last updated in NVD database

Technical Details for CVE-2026-8223

Vulnerability Analysis

The vulnerability affects the pcf_sess_sbi_discover_and_send function in the Open5GS Policy Control Function. This function handles Service-Based Interface (SBI) discovery and message dispatch for policy sessions established through the sm-policies endpoint. Manipulation of input to this function triggers improper resource handling, classified under [CWE-404] Improper Resource Shutdown or Release. The result is degraded or terminated service for policy decisions affecting subscriber sessions on the 5G core. Because PCF is central to session policy enforcement, an outage propagates to dependent network functions including SMF and AMF interactions that rely on policy responses.

Root Cause

The root cause is improper resource lifecycle management within pcf_sess_sbi_discover_and_send. When the function processes a crafted policy session request, it fails to release or properly handle session-related resources, leading to an unrecoverable state in the PCF process. This aligns with the CWE-404 classification covering resources that are not correctly shut down or released after use.

Attack Vector

The attack is network-reachable and requires no authentication or user interaction. An attacker sends a crafted request to the exposed PCF sm-policies HTTP/2 SBI endpoint. Processing of the request inside pcf_sess_sbi_discover_and_send produces the denial-of-service condition. Exploit details have been disclosed publicly through the referenced VulDB entry and the corresponding GitHub Issue #4438. Refer to the VulDB Vulnerability #362440 entry for additional technical context, and the Open5GS Repository for source-level review of the affected function.

Detection Methods for CVE-2026-8223

Indicators of Compromise

Unexpected termination or restart of the open5gs-pcfd process on core network hosts.
HTTP/2 requests to the PCF sm-policies endpoint from untrusted source addresses outside the 5G control plane.
Spikes in failed policy decision responses observed by SMF and other consumers of PCF.

Detection Strategies

Monitor PCF service logs for crashes or abnormal exits referencing pcf_sess_sbi_discover_and_send.
Inspect SBI traffic for malformed or anomalous sm-policies session creation requests.
Correlate PCF outages with concurrent inbound traffic patterns on the SBI network segment.

Monitoring Recommendations

Enable process supervision and alerting for the open5gs-pcfd daemon, including restart counters.
Capture HTTP/2 SBI traffic at the network boundary for offline analysis when anomalies occur.
Track availability metrics for PCF response latency and error rates to surface intermittent disruption.

How to Mitigate CVE-2026-8223

Immediate Actions Required

Restrict network access to the PCF sm-policies endpoint so only authorized 5G core network functions can reach it.
Place Open5GS SBI interfaces behind segmented control-plane networks, not exposed to general or external networks.
Track the upstream GitHub Issue #4438 for vendor response and patch availability.

Patch Information

At the time of publication, the Open5GS project had not responded to the issue report and no fixed release was available. Operators running Open5GS 2.7.7 or earlier should monitor the Open5GS Repository for new releases addressing pcf_sess_sbi_discover_and_send and apply updates as soon as they ship.

Workarounds

Enforce firewall rules limiting access to the PCF SBI listener to known SMF and NRF peers.
Deploy a reverse proxy or service mesh in front of SBI endpoints to validate and rate-limit sm-policies requests.
Configure automatic restart of the open5gs-pcfd service to reduce outage duration if the process exits unexpectedly.

bash

# Example: restrict access to the PCF sm-policies SBI port using nftables
# Replace <PCF_SBI_PORT> and trusted peer addresses with values for your deployment
nft add table inet open5gs_filter
nft add chain inet open5gs_filter input { type filter hook input priority 0 \; policy drop \; }
nft add rule inet open5gs_filter input ip saddr { 10.0.0.10, 10.0.0.11 } tcp dport <PCF_SBI_PORT> accept
nft add rule inet open5gs_filter input tcp dport <PCF_SBI_PORT> drop