CVE-2026-8268: DoS in Open5GS 2.7.0-2.7.7
Platform
linux
Component
open5gs
CVE-2026-8268 describes a denial-of-service (DoS) vulnerability discovered in Open5GS versions 2.7.0 through 2.7.7. The vulnerability resides within the SMF component's OpenAPIlistcreate function, allowing remote attackers to induce a service disruption. While the issue has been reported to the Open5GS project, a response has not yet been received, leaving systems potentially exposed.
Impact en Aanvalsscenarioswordt vertaald…
Successful exploitation of CVE-2026-8268 allows an attacker to remotely trigger a denial-of-service condition within the Open5GS system. This means legitimate users and services relying on Open5GS will be unable to access or utilize the affected functionality. The impact can range from temporary service outages to complete system unavailability, potentially disrupting critical network operations. The ability to launch the attack remotely significantly broadens the potential attack surface, making it easier for malicious actors to target vulnerable deployments. The lack of a response from the project increases the risk of exploitation.
Uitbuitingscontextwordt vertaald…
CVE-2026-8268 has been publicly disclosed, increasing the likelihood of exploitation. The vulnerability's DoS nature makes it a relatively simple attack to execute, potentially lowering the barrier to entry for malicious actors. The EPSS score is likely to be assessed as Medium, reflecting the public disclosure and ease of exploitation. Active campaigns targeting this vulnerability are currently unknown, but the public disclosure warrants heightened vigilance.
Dreigingsinformatie
Exploit Status
EPSS
0.04% (12% percentiel)
CVSS-vector
Wat betekenen deze metrics?
- Attack Vector
- Netwerk — op afstand uitbuitbaar via internet. Geen fysieke of lokale toegang vereist.
- Attack Complexity
- Laag — geen speciale voorwaarden vereist. Betrouwbaar uitbuitbaar.
- Privileges Required
- Laag — elk geldig gebruikersaccount is voldoende.
- User Interaction
- Geen — automatische en stille aanval. Slachtoffer doet niets.
- Scope
- Ongewijzigd — impact beperkt tot het kwetsbare component.
- Confidentiality
- Geen — geen vertrouwelijkheidsimpact.
- Integrity
- Geen — geen integriteitsimpact.
- Availability
- Laag — gedeeltelijke of intermitterende denial of service.
Getroffen Software
Zwakheidsclassificatie (CWE)
Tijdlijn
- Gepubliceerd
- EPSS bijgewerkt
Mitigatie en Workaroundswordt vertaald…
Given the lack of a patch from the Open5GS project, immediate mitigation strategies are crucial. Consider implementing rate limiting on incoming requests to the SMF component to reduce the impact of potential DoS attacks. Network firewalls can be configured to block suspicious traffic patterns. If possible, isolate the Open5GS instance within a segmented network to limit the blast radius of a successful attack. Continuously monitor system logs for unusual activity that might indicate an ongoing attack. While a direct fix is unavailable, these workarounds can help reduce the risk until a patch is released.
Hoe te verhelpenwordt vertaald…
Se recomienda actualizar Open5GS a una versión posterior a la 2.7.7 para mitigar la vulnerabilidad de denegación de servicio. Verificar la documentación oficial de Open5GS para obtener instrucciones de actualización específicas. Dado que el proyecto no ha respondido, se recomienda monitorear activamente las actualizaciones de seguridad.
Veelgestelde vragenwordt vertaald…
What is CVE-2026-8268 — DoS in Open5GS 2.7.0-2.7.7?
CVE-2026-8268 is a denial-of-service vulnerability affecting Open5GS versions 2.7.0 through 2.7.7. It allows remote attackers to disrupt service by manipulating the OpenAPIlistcreate function within the SMF component.
Am I affected by CVE-2026-8268 in Open5GS 2.7.0-2.7.7?
If you are running Open5GS version 2.7.0, 2.7.1, 2.7.2, 2.7.3, 2.7.4, 2.7.5, 2.7.6, or 2.7.7, you are potentially affected by this vulnerability.
How do I fix CVE-2026-8268 in Open5GS 2.7.0-2.7.7?
A patch is not currently available. Mitigate by implementing rate limiting, network firewall rules, and isolating the Open5GS instance.
Is CVE-2026-8268 being actively exploited?
While active campaigns are currently unknown, the vulnerability has been publicly disclosed, increasing the risk of exploitation.
Where can I find the official Open5GS advisory for CVE-2026-8268?
As of the publication date, no official advisory has been released by the Open5GS project. Monitor their website and mailing lists for updates.
Is jouw project getroffen?
Upload je dependency-bestand en kom direct te weten of deze en andere CVEs jou raken.
Probeer het nu — geen account
Upload een manifest (composer.lock, package-lock.json, WordPress pluginlijst…) of plak uw componentenlijst. U ontvangt direct een kwetsbaarheidsrapport. Een bestand uploaden is slechts het begin: met een account krijgt u continue monitoring, Slack/e-mail alerts, multi-project en white-label rapporten.
Sleep uw afhankelijkheidsbestand hierheen
composer.lock, package-lock.json, requirements.txt, Gemfile.lock, pubspec.lock, Dockerfile...