Denial of Service Vulnerability in Open5GS PCF Component
CVE-2026-8224

6.9MEDIUM

Key Information:

Vendor: Open5GS
Status: Open5gs
Vendor: CVE Published:; 10 May 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-8224?

A vulnerability exists in the Open5GS PCF component affecting versions up to 2.7.7, specifically within the function pcf_sess_set_ipv6prefix located in the /src/pcf/context.c file. By manipulating the argument SmPolicyContextData.ipv6AddressPrefix, an attacker can potentially trigger a denial of service. This attack can be executed remotely, posing a significant risk to users of Open5GS. The exploit has been publicly disclosed, and the vendor was contacted but did not respond.

Affected Version(s)

Open5GS 2.7.0

Open5GS 2.7.1

Open5GS 2.7.2

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-8224 - Proof of Concept