CVE-2026-4988

A security flaw has been discovered in Open5GS 2.7.6. This issue affects the function smf_gx_cca_cb/smf_gy_cca_cb/smf_s6b of the component CCA Message Handler. The manipulation results in denial of service. The attack may be launched remotely. Attacks of this nature are highly complex. The exploitability is assessed as difficult. The exploit has been released to the public and may be used for attacks.

• CWE-404

• https://github.com/open5gs/open5gs/Product
• https://github.com/open5gs/open5gs/issues/4342Exploit, Issue Tracking
• https://github.com/open5gs/open5gs/issues/4342#issue-4021772232Issue Tracking
• https://vuldb.com/?ctiid.353875Permissions Required, VDB Entry
• https://vuldb.com/?id.353875Third Party Advisory, VDB Entry
• https://vuldb.com/?submit.771349Exploit, Third Party Advisory, VDB Entry

Published

Mar 27, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-49871Cross-Site Request Forgery (CSRF) vulnerability in the cas-a…9.3
• CVE-2026-49872Improper Authentication vulnerability in Apache APISIX. Whe…8.1
• CVE-2026-49875Apache CXF's EndpointReferenceUtils and W3CMultiSchemaFactor…9.8
• CVE-2026-49876Authenticated SSRF in Gravitino JobManager allows server-sid…6.5
• CVE-2026-49877Improper Authorization vulnerability in Apache ActiveMQ. An…8.1
• CVE-2026-49879In multiple functions of rw_t3t.cc, there is a possible out …8.8
• CVE-2026-49881In serviceClassExists of InCallController.java, there is a p…7.8
• CVE-2026-49882In rw_mfc_handle_read_op of rw_mfc.cc, there is a possible m…8.8
• CVE-2026-49883In checkReadPermission of PermissionsManager.java, there is …5.5
• CVE-2026-49884In rw_mfc_handle_read_op of rw_mfc.cc, there is a possible o…7.8
• CVE-2026-49887In maybeRemoveInvalidInstallerPackageName of InstallReposito…7.8
• CVE-2026-4989Improper input validation in the gateway health check featur…4.3