CVE-2026-8224: Open5GS PCF Component DoS Vulnerability

CVE-2026-8224 Overview

CVE-2026-8224 affects Open5GS versions up to 2.7.7, an open-source implementation of 5G Core and EPC functions. The vulnerability resides in the pcf_sess_set_ipv6prefix function within /src/pcf/context.c, a component of the Policy Control Function (PCF). Remote attackers can manipulate the SmPolicyContextData.ipv6AddressPrefix argument to trigger a denial of service condition. The flaw is categorized under [CWE-404] (Improper Resource Shutdown or Release). The exploit has been publicly disclosed. The Open5GS maintainers were contacted before public disclosure but did not respond.

Critical Impact
Unauthenticated remote attackers can disrupt 5G core network policy control services by sending crafted IPv6 prefix data to the PCF, impacting service availability for connected subscribers.

Affected Products

Open5GS versions up to and including 2.7.7
Open5GS Policy Control Function (PCF) component
5G Core deployments using vulnerable Open5GS builds

Discovery Timeline

2026-05-10 - CVE-2026-8224 published to NVD
2026-05-12 - Last updated in NVD database

Technical Details for CVE-2026-8224

Vulnerability Analysis

The vulnerability exists in the Policy Control Function (PCF), a 5G core network component responsible for unified policy management across sessions. The affected routine pcf_sess_set_ipv6prefix in /src/pcf/context.c processes the ipv6AddressPrefix field from SmPolicyContextData, which is exchanged during session management policy creation. Improper resource handling during this processing allows a crafted prefix value to disrupt PCF operation.

An outage of the PCF cascades into session policy decisions, affecting QoS enforcement, charging, and access control for user equipment. Because PCF is centrally consulted by the Session Management Function (SMF) during PDU session establishment, disruption can degrade service for many subscribers simultaneously.

Root Cause

The root cause maps to [CWE-404] Improper Resource Shutdown or Release. The PCF context handling code does not adequately validate or release resources tied to the IPv6 prefix attribute received over the service-based interface. Malformed or unexpected input causes the function to enter an error path that leaves the process in an unrecoverable state.

Attack Vector

The attack is network-based and requires no authentication or user interaction. An attacker with reachability to the PCF service-based interface submits an Npcf_SMPolicyControl_Create request containing a manipulated ipv6AddressPrefix value within SmPolicyContextData. The malformed input forces the PCF into a denial of service state. Exploit details have been publicly disclosed via VulDB and the upstream issue tracker. Refer to GitHub Issue #4439 and VulDB #362441 for technical context.

Detection Methods for CVE-2026-8224

Indicators of Compromise

Unexpected restarts or crashes of the Open5GS PCF process correlated with inbound SBI traffic
Npcf_SMPolicyControl_Create requests containing unusual or malformed ipv6AddressPrefix values
Repeated PDU session establishment failures reported by SMF instances
Source IPs outside the trusted 5G core network range issuing PCF API calls

Detection Strategies

Inspect HTTP/2 traffic on the PCF service-based interface for malformed SmPolicyContextData payloads
Monitor PCF process health, restart counters, and core dump generation
Enable verbose logging in Open5GS to capture parameters passed to pcf_sess_set_ipv6prefix
Correlate SMF-side session creation failures with PCF availability windows

Monitoring Recommendations

Deploy network segmentation telemetry to log any non-core source reaching PCF endpoints
Track PCF API request rates and error response codes (HTTP 5xx) over time
Alert on repeated PCF crashes within short intervals as a denial of service indicator
Ingest Open5GS logs and SBI traffic metadata into a centralized analytics platform for cross-correlation

How to Mitigate CVE-2026-8224

Immediate Actions Required

Restrict network access to the PCF service-based interface to known 5G core function IP ranges only
Apply input validation at upstream NFs or service mesh gateways to reject malformed ipv6AddressPrefix values
Implement process supervision and automatic restart for the PCF to limit downtime impact
Audit Open5GS deployments to inventory versions 2.7.7 and earlier

Patch Information

At the time of publication, no official vendor patch has been released. The Open5GS maintainers were contacted prior to public disclosure but did not respond. Monitor the Open5GS GitHub repository and GitHub Issue #4439 for upstream fixes. Once a patched build is available, rebuild and redeploy PCF instances across all environments.

Workarounds

Place a reverse proxy or service mesh sidecar in front of the PCF to filter or sanitize SmPolicyContextData payloads
Enforce mutual TLS and IP allow-listing on the SBI to prevent unauthorized API access
Rate-limit Npcf_SMPolicyControl_Create requests at the network layer
Run redundant PCF instances behind a load balancer to maintain availability during single-process crashes

bash

# Example iptables rule to restrict PCF SBI access to trusted core network subnet
iptables -A INPUT -p tcp --dport 7777 -s 10.10.0.0/16 -j ACCEPT
iptables -A INPUT -p tcp --dport 7777 -j DROP