CVE-2026-8252 Overview
CVE-2026-8252 is a null pointer dereference vulnerability in Open5GS through version 2.7.7. The flaw resides in the smf_nsmf_handle_create_data_in_hsmf function within the Session Management Function (SMF) component. An authenticated remote attacker can trigger the dereference by sending crafted input to the affected function, causing the SMF process to crash. The weakness is classified under [CWE-404] (Improper Resource Shutdown or Release). The exploit has been publicly disclosed, and at the time of publication the Open5GS project had not responded to the issue report. Open5GS is a widely used open-source 5G/4G core network implementation, making availability of the SMF a relevant operational concern for telecom lab and research deployments.
Critical Impact
A remote authenticated attacker can crash the Open5GS SMF process by triggering a null pointer dereference, resulting in a denial of service against the 5G core session management plane.
Affected Products
- Open5GS versions up to and including 2.7.7
- Open5GS SMF (Session Management Function) component
- Deployments exposing the nsmf service interface to untrusted clients
Discovery Timeline
- 2026-05-11 - CVE-2026-8252 published to NVD
- 2026-05-12 - Last updated in NVD database
Technical Details for CVE-2026-8252
Vulnerability Analysis
The vulnerability exists in the smf_nsmf_handle_create_data_in_hsmf function of the Open5GS SMF component. This function handles the creation of session data within the home SMF (hSMF) role of the 3GPP Nsmf_PDUSession service. When the function processes a specific manipulated input, it dereferences a pointer that has not been validated against NULL. The resulting access to address zero causes the SMF process to terminate.
Because the SMF is responsible for PDU session establishment, modification, and release across the 5G core, an abrupt termination interrupts active subscriber sessions and prevents new sessions from being created until the process is restarted. The vulnerability is network-reachable and requires low privileges, but does not yield code execution, information disclosure, or integrity impact.
Root Cause
The root cause is missing validation of a pointer used inside smf_nsmf_handle_create_data_in_hsmf before it is dereferenced. The handler assumes a referenced structure is present in the incoming Nsmf request, but an attacker-controlled message can omit or malform the corresponding field. The handler proceeds to access the absent structure, producing a NULL dereference and process crash.
Attack Vector
The attack is performed remotely against an Open5GS deployment that exposes the SMF service-based interface. An authenticated peer in the 5G Service Based Architecture (SBA), such as a compromised or malicious network function with valid credentials, sends a crafted Nsmf_PDUSession_CreateSMContext style request to the hSMF endpoint. Processing the malformed payload triggers the dereference in smf_nsmf_handle_create_data_in_hsmf and the SMF terminates. Refer to the GitHub Issue #4446 and VulDB #362549 for additional context on the affected code path.
// No verified proof-of-concept code is available.
// See the upstream issue tracker for technical details:
// https://github.com/open5gs/open5gs/issues/4446
Detection Methods for CVE-2026-8252
Indicators of Compromise
- Unexpected termination or repeated restarts of the Open5GS open5gs-smfd process
- Crash logs or core dumps referencing smf_nsmf_handle_create_data_in_hsmf
- Sudden drops in active PDU session counts on the 5G core control plane
- Anomalous Nsmf_PDUSession requests from peer network functions containing missing or malformed payload fields
Detection Strategies
- Monitor SMF process health and exit codes using systemd, container orchestrator probes, or process supervisors
- Inspect SBA HTTP/2 traffic to the SMF for malformed JSON bodies on nsmf-pdusession endpoints
- Correlate SMF crash events with the source IP and NF identity of the most recent inbound request
Monitoring Recommendations
- Enable verbose Open5GS logging and ship logs to a centralized analytics platform for correlation
- Alert on repeated SMF restarts within a short interval, which can indicate active exploitation attempts
- Track unauthorized or unknown NF Instance IDs initiating session creation requests against the hSMF
How to Mitigate CVE-2026-8252
Immediate Actions Required
- Restrict access to the SMF service-based interface to known, authenticated 5G core network functions only
- Place the Open5GS SMF behind a service mesh or API gateway that enforces schema validation on Nsmf requests
- Increase process supervision so the SMF is automatically restarted if it terminates unexpectedly
- Audit upstream peers permitted to invoke Nsmf_PDUSession_CreateSMContext against the hSMF
Patch Information
At the time of publication, no vendor fix is referenced in the advisory. The Open5GS GitHub repository and GitHub Issue #4446 should be monitored for an upstream patch. Once a fix lands, rebuild Open5GS from the patched commit and redeploy the SMF component across all affected nodes.
Workarounds
- Segment the 5G core SBA network so the SMF is unreachable from untrusted hosts and external interfaces
- Apply mutual TLS and strict NF authorization policies to limit which peers can call the affected endpoint
- Deploy upstream input validation, such as a reverse proxy enforcing the 3GPP Nsmf_PDUSession OpenAPI schema, to reject malformed requests before they reach the SMF
# Example: restrict SMF SBA port (default 7777) to trusted NF subnet using iptables
iptables -A INPUT -p tcp --dport 7777 -s 10.10.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 7777 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
