CVE-2026-4240

A vulnerability was determined in Open5GS up to 2.7.6. The affected element is the function smf_gx_cca_cb/smf_gy_cca_cb/smf_s6b_aaa_cb/smf_s6b_sta_cb of the component CCA Handler. This manipulation causes denial of service. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. Upgrading to version 2.7.7 is sufficient to fix this issue. Patch name: 80eb484a6ab32968e755e628b70d1a9c64f012ec. Upgrading the affected component is recommended.

• CWE-404

• https://github.com/open5gs/open5gs/Product
• https://github.com/open5gs/open5gs/commit/80eb484a6ab32968e755e628b70d1a9c64f012ecPatch
• https://github.com/open5gs/open5gs/issues/4343Issue Tracking, Third Party Advisory
• https://github.com/open5gs/open5gs/issues/4343#issue-4021871895Exploit, Issue Tracking, Third Party Advisory
• https://github.com/open5gs/open5gs/releases/tag/v2.7.7Release Notes
• https://vuldb.com/?ctiid.351182Permissions Required, VDB Entry
• https://vuldb.com/?id.351182Third Party Advisory, VDB Entry
• https://vuldb.com/?submit.771361Exploit, Third Party Advisory, VDB Entry

Published

Mar 16, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-4239A vulnerability was found in Lagom WHMCS Template up to 2.3.…3.5
• CVE-2026-42390An invalid zone might pass ZONEMD validation while it should…5.3
• CVE-2026-42396Insufficient Validation of Member Zone Data May Cause Catalo…6.5
• CVE-2026-42397Allocation of Resources Without Limits or Throttling (CWE-77…6.5
• CVE-2026-42398Server-Side Request Forgery (CWE-918) in Kibana allows authe…7.7
• CVE-2026-42399Uncontrolled Resource Consumption (CWE-400) in Kibana can le…6.5
• CVE-2026-42400Uncontrolled Resource Consumption (CWE-400) in Kibana can le…6.5
• CVE-2026-42401Improper Neutralization of Input During Web Page Generation …5.4
• CVE-2026-42402Apache Neethi is vulnerable to a Denial of Service attack th…7.5
• CVE-2026-42403Apache Neethi does not properly detect circular references i…7.5
• CVE-2026-42404Apache Neethi does not impose any restrictions on URIs when …7.2
• CVE-2026-42406A vulnerability exists in BIG-IP and BIG-IQ systems where a …8.7