CVE-2026-8289: Open5GS SMF DoS Vulnerability

CVE-2026-8289 Overview

CVE-2026-8289 is a denial-of-service vulnerability in Open5GS versions up to 2.7.7. The flaw resides in the smf_nsmf_handle_update_data_in_vsmf function within /src/smf/nsmf-handler.c, part of the Session Management Function (SMF) component. Manipulation of the qosFlowProfile argument triggers improper resource handling [CWE-404], leading to service disruption. The vulnerability is remotely exploitable by an authenticated low-privilege attacker. A public exploit reference has been disclosed, and the Open5GS project has not yet responded to the issue report. Affected operators of 5G core network deployments built on Open5GS may experience SMF outages.

Critical Impact
Remote attackers with low privileges can disrupt 5G Session Management Function availability by sending crafted qosFlowProfile data to the vSMF update handler.

Affected Products

Open5GS versions up to and including 2.7.7
Open5GS SMF component (/src/smf/nsmf-handler.c)
5G core network deployments using affected Open5GS builds

Discovery Timeline

2026-05-11 - CVE-2026-8289 published to NVD
2026-05-12 - Last updated in NVD database

Technical Details for CVE-2026-8289

Vulnerability Analysis

The vulnerability resides in the Open5GS Session Management Function (SMF), a core component of 5G Service-Based Architecture (SBA). The defective function smf_nsmf_handle_update_data_in_vsmf processes update requests for the visited SMF (vSMF) in roaming scenarios. When the handler receives a crafted qosFlowProfile argument, it fails to properly release or manage allocated resources, classified under Improper Resource Shutdown or Release [CWE-404]. This condition results in a denial-of-service state that affects subscriber session management. Because SMF availability is essential to PDU session establishment and modification, an outage prevents devices from setting up or maintaining 5G data sessions.

Root Cause

The root cause is improper handling of the qosFlowProfile parameter within the Nsmf interface handler. Open5GS does not enforce sufficient validation or lifecycle management on this input, allowing malformed data to drive the SMF into an unstable state. The defect is tracked through Open5GS GitHub Issue #4453.

Attack Vector

The attack vector is network-based and requires low-level privileges to reach the Nsmf interface. An attacker positioned within the 5G Service-Based Interface (SBI) plane, or one able to impersonate a peer network function, can send crafted update data targeting the vSMF handler. No user interaction is required, and successful exploitation degrades SMF availability without affecting confidentiality or integrity.

No verified proof-of-concept code is published. Refer to the Open5GS GitHub Issue #4453 for technical context on the defective handler.

Detection Methods for CVE-2026-8289

Indicators of Compromise

Unexpected restarts or crashes of the Open5GS SMF process following Nsmf update requests
Surge of PDU session establishment failures reported by connected AMF or UPF instances
Malformed qosFlowProfile payloads observed in SBI traffic captures targeting the vSMF endpoint

Detection Strategies

Inspect SBI HTTP/2 traffic to the Nsmf interface for anomalous or oversized qosFlowProfile JSON structures
Correlate SMF process termination events with inbound nsmf-pdusession update requests in centralized logs
Baseline expected SMF request rates and alert on sudden drops in successful session establishments

Monitoring Recommendations

Enable verbose logging on the Open5GS SMF and forward logs to a centralized log analytics platform
Monitor service-mesh or API gateway telemetry between 5G network functions for repeated Nsmf update failures
Track SMF container or process restart counts in orchestration platforms such as Kubernetes

How to Mitigate CVE-2026-8289

Immediate Actions Required

Restrict network access to the Open5GS SMF Nsmf interface to trusted 5G core network functions only
Place a service mesh or SBI proxy in front of the SMF to validate qosFlowProfile payload structure
Increase monitoring of SMF process health and configure automated restart with rate limits

Patch Information

The Open5GS maintainers have not yet acknowledged or released a fix at the time of publication. Track Open5GS GitHub Issue #4453 and the Open5GS repository for upstream patches. Operators should upgrade as soon as a corrected release is published beyond version 2.7.7.

Workarounds

Apply network policies that allow Nsmf traffic only from authenticated, authorized network functions within the trusted SBA domain
Deploy mutual TLS and OAuth 2.0 token validation on the SBI to reduce the attacker pool able to reach the handler
Use rate limiting on Nsmf update requests to slow exploitation attempts and contain impact

bash

# Example iptables rule restricting Nsmf access to trusted peers
iptables -A INPUT -p tcp --dport 7777 -s 10.0.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 7777 -j DROP