CVE-2026-8225: Open5GS Denial of Service Vulnerability

CVE-2026-8225 Overview

CVE-2026-8225 is a denial of service vulnerability in Open5GS versions up to 2.7.7. The flaw resides in the pcf_npcf_smpolicycontrol_handle_delete function within src/pcf/sm-sm.c, part of the Policy Control Function (PCF) delete endpoint. Remote attackers can manipulate this function to trigger a denial of service condition without authentication or user interaction. The issue is tracked as [CWE-404] (Improper Resource Shutdown or Release). According to the vulnerability disclosure, a public exploit is available and the maintainers had not responded to the early issue report at the time of publication.

Critical Impact
Unauthenticated remote attackers can disrupt the PCF component of Open5GS deployments, affecting 5G core network policy control availability.

Affected Products

Open5GS versions up to and including 2.7.7
Open5GS PCF (Policy Control Function) component
Deployments exposing the npcf-smpolicycontrol delete endpoint

Discovery Timeline

2026-05-10 - CVE-2026-8225 published to NVD
2026-05-12 - Last updated in NVD database

Technical Details for CVE-2026-8225

Vulnerability Analysis

Open5GS implements the 5G core network functions, including the Policy Control Function (PCF) responsible for enforcing session management policies. The vulnerable code path is the pcf_npcf_smpolicycontrol_handle_delete function in src/pcf/sm-sm.c, which handles incoming Npcf_SMPolicyControl delete requests from the Session Management Function (SMF).

When the delete endpoint processes a crafted request, the function fails to release or validate associated resources correctly. The mishandled resource shutdown causes the PCF process to enter an unstable state, terminating service availability for legitimate policy control operations. Because the PCF is a central component in 5G session establishment, its unavailability cascades into broader session setup failures across the core network.

Root Cause

The root cause is improper resource shutdown or release within the SM Policy Control delete handler. The function does not adequately validate or clean up policy association state when processing a delete operation, which leads to an abnormal termination or hang condition consistent with [CWE-404]. Public disclosure on the project's GitHub issue tracker provides additional context for the defect.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker with network reachability to the PCF service-based interface (SBI) sends a crafted HTTP/2 delete request to the npcf-smpolicycontrol resource. Because 5G core service-based interfaces are typically reachable from peer network functions, an attacker who compromises any adjacent NF or gains access to the operator's SBI network can trigger the condition. The exploit is publicly available according to the vulnerability disclosure.

The vulnerability is described in prose because no verified exploit code is published in this article. Refer to the GitHub Issue #4440 for the original report and the Open5GS Repository for source review.

Detection Methods for CVE-2026-8225

Indicators of Compromise

Unexpected PCF process crashes, restarts, or hangs correlated with inbound DELETE requests to /npcf-smpolicycontrol/v1/sm-policies/{policyId}
Spikes in 5xx responses or connection resets from the PCF SBI endpoint
SMF logs reporting failed Npcf_SMPolicyControl_Delete transactions and policy association timeouts

Detection Strategies

Monitor PCF logs for abnormal termination of policy association handling within pcf_npcf_smpolicycontrol_handle_delete
Correlate inbound HTTP/2 DELETE requests on the SBI with PCF service availability metrics to identify trigger patterns
Deploy SBI-layer anomaly detection to flag malformed or repeated delete requests from unexpected source NFs

Monitoring Recommendations

Track PCF uptime, restart counts, and dropped session counts as availability KPIs
Alert on any sustained 5G session establishment failure rate exceeding baseline thresholds
Forward Open5GS logs and SBI access traces to a centralized SIEM for retention and cross-NF correlation

How to Mitigate CVE-2026-8225

Immediate Actions Required

Restrict network access to the PCF SBI so only authorized 5G core network functions can reach the npcf-smpolicycontrol endpoint
Rate-limit DELETE requests to the SM Policy Control resource at the service mesh or API gateway layer
Monitor PCF process health and configure automated restart with alerting to limit outage duration

Patch Information

At the time of publication, the Open5GS maintainers had not responded to the issue report referenced in the CVE record. Operators should track the Open5GS GitHub repository and Issue #4440 for fix availability. Until an official patch is released, upgrade plans should include validation against the vulnerable code path in src/pcf/sm-sm.c.

Workarounds

Place the PCF behind a service mesh proxy that enforces strict authentication and authorization for all SBI consumers
Deploy network segmentation to isolate the SBI plane from any management or external networks
Implement schema validation on the API gateway to reject malformed npcf-smpolicycontrol delete requests before they reach the PCF

bash

# Example iptables restriction limiting PCF SBI access to known SMF peers
iptables -A INPUT -p tcp --dport 7777 -s <SMF_IP> -j ACCEPT
iptables -A INPUT -p tcp --dport 7777 -j DROP