CVE-2026-8289

A vulnerability was identified in Open5GS up to 2.7.7. This vulnerability affects the function smf_nsmf_handle_update_data_in_vsmf of the file /src/smf/nsmf-handler.c of the component SMF. The manipulation of the argument qosFlowProfile leads to denial of service. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.

• CWE-404

• https://github.com/open5gs/open5gs/Product
• https://github.com/open5gs/open5gs/issues/4453Exploit, Issue Tracking
• https://vuldb.com/submit/808490Third Party Advisory, VDB Entry
• https://vuldb.com/vuln/362586Third Party Advisory, VDB Entry
• https://vuldb.com/vuln/362586/ctiPermissions Required, VDB Entry

Published

May 11, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-82881Aix-DB through 1.2.4 renders markdown with raw HTML enabled …5.4
• CVE-2026-82882Devtron through 2.2.0 fails to enforce authorization checks …8.8
• CVE-2026-82883Improper Neutralization of Input During Web Page Generation …7.1
• CVE-2026-82884The All in One SEO WordPress plugin before 5.0.0.1 does not …6.8
• CVE-2026-82885IBM Guardium Data Protection 12.2 could allow a remote authe…8.8
• CVE-2026-82887IBM Guardium Data Protection 12.2 could allow a remote authe…8.8
• CVE-2026-82890IBM Guardium Data Protection 12.2 could allow a remote authe…5.9
• CVE-2026-82892IBM Guardium Data Protection 12.2 could allow a remote attac…8.1
• CVE-2026-82893IBM Guardium Data Protection 12.2 could allow a local attack…7.8
• CVE-2026-82896IBM Guardium Data Protection 12.2 could allow a remote authe…7.6
• CVE-2026-8290A security flaw has been discovered in Open5GS up to 2.7.7. …6.5
• CVE-2026-82905A vulnerability was detected in sdcb chats up to 1.12.0. Thi…6.3