CVE-2026-8223

HighCVSS 7.5/10Last modified Jul 24, 2026

Description

A vulnerability was found in Open5GS up to 2.7.7. Affected by this vulnerability is the function pcf_sess_sbi_discover_and_send of the component sm-policies Endpoint. Performing a manipulation results in denial of service. It is possible to initiate the attack remotely. The exploit has been made public and could be used. The project was informed of the problem early through an issue report but has not responded yet.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-404

Affected software

Vendor	Product	Versions
n/a	Open5GS	2.7.0; 2.7.1; 2.7.2; 2.7.3; 2.7.4; 2.7.5; 2.7.6; 2.7.7

References

https://github.com/open5gs/open5gs/Product
https://github.com/open5gs/open5gs/issues/4438Exploit, Issue Tracking
https://vuldb.com/submit/808442Third Party Advisory, VDB Entry
https://vuldb.com/vuln/362440Third Party Advisory, VDB Entry
https://vuldb.com/vuln/362440/ctiPermissions Required, VDB Entry
https://vuldb.com/submit/808442Third Party Advisory, VDB Entry

Timeline

Published: May 10, 2026
Last modified: Jul 24, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-822307.5Uncontrolled recursion in the mcpack2pb component in Apache bRPC (version < 1.18.0) on all platforms allows remote attackers to make the ser CVE-2026-822317.5A Thrift client in Apache bRPC (version < 1.18.0, built with WITH_THRIFT which is off by default) can be crashed by the server peer it talks CVE-2026-822329.8Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Apache Syncope. An administrator wi CVE-2026-822335.7SiYuan before v3.8.1 contains a path traversal vulnerability in the asset.upload MCP tool that accepts arbitrary absolute file paths without CVE-2026-822348.2SiYuan versions before v3.8.1 contain a server-side request forgery vulnerability in the http_request and web_fetch agent tools that perform CVE-2026-822355.9filebrowser through 2.63.23 fails to validate named pipes in directory archive and public download handlers, allowing attackers to trigger b CVE-2026-822363.1File Browser versions from 2.63.6 through 2.63.23 fail to clean up public share links when a privileged user deletes another user's shared f CVE-2026-822373.1filebrowser through 2.63.23 does not remove share records when a shared file is renamed (only deletion triggers share cleanup). The share re CVE-2026-822383.1filebrowser from version 2.24.0 contains a race condition in the TUS upload handler that allows authenticated users to write past the declar CVE-2026-822398.1Budibase before 3.41.3 fails to enforce per-table role restrictions on the POST /api/datasources/query endpoint, allowing low-privilege BASI CVE-2026-82247.5A vulnerability was determined in Open5GS up to 2.7.7. Affected by this issue is the function pcf_sess_set_ipv6prefix of the file /src/pcf/c CVE-2026-822408.1Budibase before 3.41.3 fails to validate app-scoped builder role assignments in the public user create and update endpoints, allowing an aut