CVE-2026-8226: Open5GS Denial of Service Vulnerability

CVE-2026-8226 Overview

CVE-2026-8226 is a denial of service vulnerability in Open5GS versions up to 2.7.7. The flaw resides in the ogs_pcc_rule_install_flow_from_media function within the /lib/proto/types.c library. An attacker can manipulate input to this function to trigger a denial of service condition on the affected service. The attack is remotely exploitable and requires no authentication or user interaction. Public exploit details have been released, increasing the risk of opportunistic attacks against exposed Open5GS deployments. The project maintainers were notified through an issue report but had not responded at the time of disclosure. This vulnerability is classified under [CWE-404] (Improper Resource Shutdown or Release).

Critical Impact
Remote unauthenticated attackers can disrupt Open5GS 5G/LTE core network services, affecting availability of mobile network functions.

Affected Products

Open5GS versions up to and including 2.7.7
The ogs_pcc_rule_install_flow_from_media function in /lib/proto/types.c
Deployments exposing Open5GS network functions to untrusted networks

Discovery Timeline

2026-05-10 - CVE-2026-8226 published to NVD
2026-05-12 - Last updated in NVD database

Technical Details for CVE-2026-8226

Vulnerability Analysis

Open5GS is an open-source implementation of 5G Core and EPC (Evolved Packet Core) network functions. The vulnerability affects the Policy and Charging Control (PCC) rule processing logic in the function ogs_pcc_rule_install_flow_from_media. This function installs traffic flow rules derived from media descriptions during session management operations. Improper handling of resources during rule installation allows a remote attacker to cause a denial of service. The result is degraded availability of core mobile network signaling, potentially disrupting subscriber session establishment and policy enforcement. EPSS data places the exploitation probability at 0.082% (percentile 23.828) as of 2026-05-17.

Root Cause

The root cause maps to [CWE-404], Improper Resource Shutdown or Release. The ogs_pcc_rule_install_flow_from_media function in /lib/proto/types.c fails to correctly manage resources when processing crafted media flow input. This improper release leads to a state that crashes or hangs the affected process, terminating the network function and breaking dependent control-plane operations.

Attack Vector

The attack is network-based and requires no authentication or user interaction. An attacker who can deliver crafted PCC rule or media-flow data to an Open5GS network function reachable over the network can trigger the flaw. Because Open5GS components typically run as long-lived services handling subscriber traffic, a single successful request can degrade availability for many users. Public exploit information has been released, so defenders should assume opportunistic scanning. See the GitHub Issue #4441 and the VulDB #362443 report for further technical context.

Detection Methods for CVE-2026-8226

Indicators of Compromise

Unexpected crashes, restarts, or hangs of Open5GS network function processes such as SMF, PCF, or related daemons
Error or assertion entries referencing ogs_pcc_rule_install_flow_from_media or /lib/proto/types.c in Open5GS logs
Sudden spikes in PCC rule installation failures or session establishment errors

Detection Strategies

Monitor Open5GS process supervisors for repeated service restarts correlated with inbound signaling traffic
Inspect application logs for malformed PCC rule or media component parsing errors immediately preceding service termination
Correlate network-side anomalies (failed PDU session establishment) with control-plane error events to identify exploitation attempts

Monitoring Recommendations

Forward Open5GS logs and process telemetry to a centralized analytics platform for crash-pattern correlation
Track baseline rates of PCC rule installation and alert on deviations that suggest abuse of the affected function
Enable host-level monitoring on Open5GS servers to capture core dumps and stack traces referencing the vulnerable function

How to Mitigate CVE-2026-8226

Immediate Actions Required

Restrict network access to Open5GS control-plane interfaces using firewalls and segmentation, allowing only trusted peers
Track the Open5GS GitHub repository and Issue #4441 for an official patch
Deploy process supervision to automatically restart crashed Open5GS services and limit the duration of any outage

Patch Information

At the time of publication, the Open5GS project had not responded to the issue report and no official fix has been released for versions through 2.7.7. Operators should monitor the upstream Open5GS repository for a patched release and apply it as soon as it becomes available.

Workarounds

Apply strict network ACLs so only authenticated peer network functions can reach SMF, PCF, and related Open5GS components
Place Open5GS interfaces behind a signaling firewall or service mesh that can validate and rate-limit PCC-related messages
Use rate limiting and connection quotas to slow the impact of repeated malformed requests from a single source

bash

# Configuration example: restrict Open5GS control-plane ports to trusted peers
# Replace interface and peer IPs with values appropriate to your deployment
iptables -A INPUT -p sctp -s 10.0.0.0/24 -j ACCEPT
iptables -A INPUT -p sctp -j DROP
iptables -A INPUT -p udp --dport 2123 -s 10.0.0.0/24 -j ACCEPT
iptables -A INPUT -p udp --dport 2123 -j DROP