CVE-2026-8251 Overview
CVE-2026-8251 is a denial of service vulnerability in Open5GS versions up to 2.7.7. The flaw resides in the update_authorized_pcc_rule_and_qos function within /src/smf/npcf-handler.c, a component of the Session Management Function (SMF). An authenticated remote attacker can manipulate input to trigger improper resource handling [CWE-404], disrupting the SMF service. Open5GS is an open source implementation of 5G Core and EPC, widely used in mobile network research and private 5G deployments. The exploit details have been disclosed publicly, and the project maintainers have not yet responded to the reported issue.
Critical Impact
Remote attackers with low privileges can disrupt the Open5GS SMF component, impacting availability of 5G core session management.
Affected Products
- Open5GS versions up to and including 2.7.7
- Open5GS Session Management Function (SMF) component
- Deployments using the npcf-handler.c PCC rule and QoS update path
Discovery Timeline
- 2026-05-10 - CVE-2026-8251 published to NVD
- 2026-05-12 - Last updated in NVD database
Technical Details for CVE-2026-8251
Vulnerability Analysis
The vulnerability exists in the update_authorized_pcc_rule_and_qos function in /src/smf/npcf-handler.c. This function handles Policy and Charging Control (PCC) rule and Quality of Service (QoS) updates received from the Policy Control Function (PCF) over the Npcf interface. Improper resource handling during the rule and QoS update process allows an attacker to trigger a denial of service condition in the SMF. The Session Management Function manages PDU sessions in 5G core networks, so disruption affects subscriber session establishment and modification. The weakness maps to [CWE-404] (Improper Resource Shutdown or Release).
Root Cause
The root cause is improper resource handling in the PCC rule and QoS authorization update path. When the SMF processes a crafted update request, the function fails to manage internal resources correctly, leading to a service-affecting condition. The Open5GS issue tracker contains additional technical context in the original report.
Attack Vector
The attack vector is network-based and requires low privileges. An attacker with the ability to reach the SMF's Npcf-facing interface can send manipulated PCC rule or QoS update messages. No user interaction is required. The exploit has been made public according to the VulDB submission record.
No verified proof-of-concept code is available for inclusion. Refer to the GitHub Issue Tracker and VulDB Vulnerability #362548 for technical details.
Detection Methods for CVE-2026-8251
Indicators of Compromise
- Unexpected restarts or crashes of the Open5GS SMF process
- Abnormal volume of PCC rule or QoS update messages on the Npcf interface
- Failed PDU session establishment or modification events in SMF logs
- Spikes in error logs from the update_authorized_pcc_rule_and_qos function path
Detection Strategies
- Monitor SMF process health, restart counts, and worker thread state for anomalies
- Inspect Npcf interface traffic for malformed or repeated PCC/QoS update messages
- Correlate session failure rates across UEs with SMF service events
Monitoring Recommendations
- Enable verbose logging for the SMF npcf-handler module and forward to a central log store
- Alert on SMF crash signatures and abrupt drops in active PDU session counts
- Track Npcf message rates per source PCF and flag deviations from baseline
How to Mitigate CVE-2026-8251
Immediate Actions Required
- Restrict network access to the SMF Npcf interface to trusted PCF endpoints only
- Apply strict network segmentation between 5G core network functions and untrusted networks
- Monitor the Open5GS GitHub repository for an upstream fix and security advisory
- Track the GitHub Issue Tracker for maintainer response and patch availability
Patch Information
No official patch has been released at the time of publication. The project was informed through an issue report but has not responded yet. Operators should monitor the Open5GS repository for fix commits to /src/smf/npcf-handler.c.
Workarounds
- Apply firewall rules limiting Npcf traffic to authorized PCF source addresses
- Deploy rate limiting on the Npcf interface to constrain abusive update message volumes
- Run the SMF process under a supervisor that restarts the service on failure to reduce outage duration
- Isolate Open5GS deployments to lab or controlled environments until a fix is available
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
