{"id":"CVE-2026-8223","state":"PUBLISHED","title":"Open5GS sm-policies Endpoint pcf_sess_sbi_discover_and_send denial of service","description":"A vulnerability was found in Open5GS up to 2.7.7. Affected by this vulnerability is the function pcf_sess_sbi_discover_and_send of the component sm-policies Endpoint. Performing a manipulation results in denial of service. It is possible to initiate the attack remotely. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.","publishedAt":"2026-05-10T02:45:08.468Z","updatedAt":"2026-05-11T15:05:49.198Z","severity":{"score":6.9,"label":"Medium","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P","source":"VulDB"},"assigner":"VulDB","products":["n/a Open5GS"],"affected":[{"vendor":"n/a","product":"Open5GS","versions":[{"version":"2.7.0","status":"affected"},{"version":"2.7.1","status":"affected"},{"version":"2.7.2","status":"affected"},{"version":"2.7.3","status":"affected"},{"version":"2.7.4","status":"affected"},{"version":"2.7.5","status":"affected"},{"version":"2.7.6","status":"affected"},{"version":"2.7.7","status":"affected"}],"cpes":["cpe:2.3:a:open5gs:open5gs:*:*:*:*:*:*:*:*"],"modules":["sm-policies Endpoint"]}],"references":["https://vuldb.com/vuln/362440","https://vuldb.com/vuln/362440/cti","https://vuldb.com/submit/808442","https://github.com/open5gs/open5gs/issues/4438","https://github.com/open5gs/open5gs/"],"weaknesses":["CWE-404"],"ingestedAt":"2026-10-29T20:13:26.108Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/8xxx/CVE-2026-8223.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-8223","state":"PUBLISHED","datePublished":"2026-05-10T02:45:08.468Z","dateUpdated":"2026-05-11T15:05:49.198Z","assignerShortName":"VulDB","assignerOrgId":"1af790b2-7ee1-4545-860a-a788eba489b5","dateReserved":"2026-05-09T07:35:21.709Z"},"containers":{"cna":{"title":"Open5GS sm-policies Endpoint pcf_sess_sbi_discover_and_send denial of service","descriptions":[{"lang":"en","value":"A vulnerability was found in Open5GS up to 2.7.7. Affected by this vulnerability is the function pcf_sess_sbi_discover_and_send of the component sm-policies Endpoint. Performing a manipulation results in denial of service. It is possible to initiate the attack remotely. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet."}],"affected":[{"vendor":"n/a","product":"Open5GS","versions":[{"version":"2.7.0","status":"affected"},{"version":"2.7.1","status":"affected"},{"version":"2.7.2","status":"affected"},{"version":"2.7.3","status":"affected"},{"version":"2.7.4","status":"affected"},{"version":"2.7.5","status":"affected"},{"version":"2.7.6","status":"affected"},{"version":"2.7.7","status":"affected"}],"cpes":["cpe:2.3:a:open5gs:open5gs:*:*:*:*:*:*:*:*"],"modules":["sm-policies Endpoint"]}],"references":[{"url":"https://vuldb.com/vuln/362440","name":"VDB-362440 | Open5GS sm-policies Endpoint pcf_sess_sbi_discover_and_send denial of service","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/vuln/362440/cti","name":"VDB-362440 | CTI Indicators (IOB, IOC, TTP, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/submit/808442","name":"Submit #808442 | Open5gs PCF v2.7.7 Denial of Service","tags":["third-party-advisory"]},{"url":"https://github.com/open5gs/open5gs/issues/4438","tags":["exploit","issue-tracking"]},{"url":"https://github.com/open5gs/open5gs/","tags":["product"]}],"metrics":[{"cvssV4_0":{"version":"4.0","baseScore":6.9,"vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P","baseSeverity":"MEDIUM"}},{"cvssV3_1":{"version":"3.1","baseScore":5.3,"vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:R","baseSeverity":"MEDIUM"}},{"cvssV3_0":{"version":"3.0","baseScore":5.3,"vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:R","baseSeverity":"MEDIUM"}},{"cvssV2_0":{"version":"2.0","baseScore":5,"vectorString":"AV:N/AC:L/Au:N/C:N/I:N/A:P/E:POC/RL:ND/RC:UR"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-404","type":"CWE","lang":"en","description":"Denial of Service"}]}],"providerMetadata":{"shortName":"VulDB","orgId":"1af790b2-7ee1-4545-860a-a788eba489b5","dateUpdated":"2026-05-10T02:45:08.468Z"},"timeline":[{"time":"2026-05-09T00:00:00.000Z","lang":"en","value":"Advisory disclosed"},{"time":"2026-05-09T02:00:00.000Z","lang":"en","value":"VulDB entry created"},{"time":"2026-05-09T09:40:37.000Z","lang":"en","value":"VulDB entry last update"}],"credits":[{"lang":"en","value":"LinZiyu (VulDB User)","type":"reporter"},{"lang":"en","value":"VulDB CNA Team","type":"coordinator"}]},"adp":[{"title":"CISA ADP Vulnrichment","references":[{"url":"https://vuldb.com/submit/808442","tags":["exploit"]}],"metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-05-11T15:05:27.789695Z","id":"CVE-2026-8223","options":[{"Exploitation":"poc"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-05-11T15:05:49.198Z"}}]}}}