CVE-2026-8119

LOW

Open5GS NSSF nghttp2-server.c ogs_sbi_stream_find_by_id denial of service

Title source: cna
STIX 2.1

Description

A vulnerability was detected in Open5GS up to 2.7.7. Impacted is the function ogs_sbi_stream_find_by_id in the library /lib/sbi/nghttp2-server.c of the component NSSF. Performing a manipulation results in denial of service. Attacking locally is a requirement. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet.

References (5)

Core 5
Core References
Vdb Entry, Technical Description vdb-entry technical-description
VDB-361906 | Open5GS NSSF nghttp2-server.c ogs_sbi_stream_find_by_id denial of service
https://vuldb.com/vuln/361906
Signature, Permissions Required signature permissions-required
VDB-361906 | CTI Indicators (IOB, IOC, IOA)
https://vuldb.com/vuln/361906/cti
Third Party Advisory third-party-advisory
Submit #808420 | Open5gs NSSF v2.7.7 Denial of Service
https://vuldb.com/submit/808420
Exploit exploit issue-tracking
https://github.com/open5gs/open5gs/issues/4431

Scores

CVSS v3 3.3
EPSS 0.0020
EPSS Percentile 10.1%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact partial

Details

CWE
CWE-404
Status published
Products (9)
None/Open5GS 2.7.0
None/Open5GS 2.7.1
None/Open5GS 2.7.2
None/Open5GS 2.7.3
None/Open5GS 2.7.4
None/Open5GS 2.7.5
None/Open5GS 2.7.6
None/Open5GS 2.7.7
open5gs/open5gs < 2.7.7
Published May 08, 2026
Tracked Since May 08, 2026