CVE-2026-8266: Open5GS SMF Denial of Service Vulnerability

CVE-2026-8266 Overview

CVE-2026-8266 is a denial of service vulnerability in Open5GS versions up to 2.7.7. The flaw resides in the gsm_build_pdu_session_establishment_accept function within /src/smf/gsm-build.c, part of the Session Management Function (SMF) component. An authenticated remote attacker can manipulate input to trigger a service disruption in the SMF. A public exploit is available, increasing exposure risk for operators running affected 5G core deployments. The Open5GS project received an issue report but has not responded at the time of disclosure. The weakness is categorized under [CWE-404] (Improper Resource Shutdown or Release).

Critical Impact
Remote attackers with low privileges can disrupt the Session Management Function, interrupting PDU session establishment for 5G subscribers.

Affected Products

Open5GS versions up to and including 2.7.7
Open5GS SMF component (/src/smf/gsm-build.c)
Deployments using gsm_build_pdu_session_establishment_accept for PDU session signaling

Discovery Timeline

2026-05-11 - CVE-2026-8266 published to NVD
2026-05-12 - Last updated in NVD database

Technical Details for CVE-2026-8266

Vulnerability Analysis

The vulnerability affects the gsm_build_pdu_session_establishment_accept function in the Open5GS SMF. The SMF handles PDU (Packet Data Unit) session lifecycle operations in a 5G core network. When the function constructs a PDU Session Establishment Accept message, crafted input causes improper resource handling. The result is a denial of service condition affecting the SMF process.

Because the SMF is central to 5G session management, disruption blocks new subscriber sessions and may affect existing ones. The attack requires network access and low-level authentication but no user interaction. The exploit is publicly available, per the VulDB Vulnerability #362563 entry.

Root Cause

The root cause is improper resource shutdown or release [CWE-404] inside the PDU session accept builder. The function fails to correctly manage allocated resources or message state when constructing the response. This leads to an unstable condition that terminates or stalls the SMF process. Details of the report are tracked in GitHub Issue #4447.

Attack Vector

The attack vector is the network. An adversary with valid low-privilege access to the 5G signaling plane sends crafted session establishment traffic toward the SMF. Processing the malformed request inside gsm_build_pdu_session_establishment_accept triggers the resource failure. No code execution occurs, but service availability degrades. See the Open5GS source repository for the affected component.

Detection Methods for CVE-2026-8266

Indicators of Compromise

Unexpected restarts or crashes of the Open5GS SMF process
Repeated PDU session establishment failures across multiple subscribers
Abnormal volume of malformed NAS 5G Session Management (5GSM) messages reaching the SMF

Detection Strategies

Monitor SMF process health and log output for abnormal termination of the gsm_build_pdu_session_establishment_accept code path
Inspect signaling traffic for malformed PDU Session Establishment Request messages that precede SMF instability
Correlate subscriber session failure rates with control-plane error logs to identify exploitation patterns

Monitoring Recommendations

Enable verbose SMF logging during evaluation windows to capture the input that triggers the fault
Track AMF-to-SMF N11 interface error rates and SMF restart counts via metrics collectors
Alert on sustained spikes in 5GSM cause codes associated with session establishment rejection

How to Mitigate CVE-2026-8266

Immediate Actions Required

Restrict network exposure of the SMF to trusted 5G core elements and management hosts only
Apply rate limiting and authentication policies on signaling interfaces feeding the SMF
Monitor the Open5GS GitHub repository and Issue #4447 for an official patch

Patch Information

At the time of publication, the Open5GS project has not released a fix. The maintainers were notified through an issue report but have not responded. Operators should track the upstream repository for commits referencing gsm_build_pdu_session_establishment_accept and version 2.7.7+ releases.

Workarounds

Segment the 5G control plane so only authorized network functions can reach the SMF
Deploy intrusion detection signatures for malformed PDU Session Establishment messages on N11 and N1/N2 paths
Implement automatic SMF process supervision to reduce recovery time after a crash
Consider pinning to a non-affected fork or applying a community patch once available

bash

# Configuration example: restrict SMF SBI bind address to internal core network
# /etc/open5gs/smf.yaml
smf:
  sbi:
    server:
      - address: 10.10.0.5
        port: 7777
    client:
      scp:
        - uri: http://10.10.0.200:7777