CVE-2026-8250 in Open5GS
Summary
by MITRE • 05/11/2026
A vulnerability has been found in Open5GS up to 2.7.7. This affects the function smf_n4_build_qos_flow_to_modify_list of the file /src/smf/n4-build.c of the component SMF. Such manipulation leads to denial of service. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 05/11/2026
The vulnerability identified in Open5GS version 2.7.7 and earlier represents a critical denial of service condition within the Session Management Function component. This flaw exists in the smf_n4_build_qos_flow_to_modify_list function located in the /src/smf/n4-build.c file, which forms a core component of the 5G core network infrastructure. The issue stems from inadequate input validation and processing within the Quality of Service flow modification handling mechanism, creating a pathway for malicious actors to disrupt normal network operations.
The technical implementation of this vulnerability involves manipulation of the QoS flow modification list construction process, which occurs during the handling of session management messages within the SMF module. When the smf_n4_build_qos_flow_to_modify_list function processes malformed or specially crafted input parameters, it fails to properly validate the incoming data structures, leading to potential buffer overflows, memory corruption, or infinite loop conditions. This function serves as a critical interface for managing QoS parameters between the user plane and control plane components, making it a prime target for exploitation.
The operational impact of this vulnerability extends beyond simple service disruption, as it affects the fundamental reliability of 5G network sessions. Remote exploitation allows attackers to trigger denial of service conditions that can affect multiple user sessions simultaneously, potentially causing widespread disruption to mobile network services. The vulnerability's public disclosure status increases the risk profile significantly, as malicious actors can readily implement exploitation techniques without requiring advanced skills or specialized tools. Network operators relying on affected Open5GS versions face potential service degradation or complete session termination for subscribers within their coverage areas.
The attack vector for this vulnerability is entirely remote, meaning that malicious actors can exploit the flaw from outside the network perimeter without requiring physical access or network credentials. This characteristic aligns with common attack patterns identified in the ATT&CK framework under the T1190 technique for Exploit Public-Facing Application, where adversaries target network services to gain unauthorized access or disrupt operations. The vulnerability's classification as a denial of service condition fits within CWE-400, which covers "Uncontrolled Resource Consumption" and related resource exhaustion issues that can lead to service disruption.
Mitigation strategies should prioritize immediate patch application to the latest Open5GS versions that contain the resolved vulnerability. Network administrators must implement network segmentation and monitoring to detect anomalous QoS modification patterns that could indicate exploitation attempts. The implementation of rate limiting and input validation controls within the SMF component can provide additional defense-in-depth measures. Organizations should also consider deploying intrusion detection systems that can identify malicious traffic patterns targeting the specific function affected by this vulnerability. The lack of response from the project team underscores the importance of maintaining alternative communication channels and community engagement to ensure timely resolution of critical security issues in open source software components.