CVE-2026-4988: Open5GS CCA Message smf_s6b denial of service

Published Mar 27, 2026

Updated

A security flaw has been discovered in Open5GS 2.7.6. This issue affects the function smfgxccacb/smfgyccacb/smfs6b of the component CCA Message Handler. The manipulation results in denial of service. The attack may be launched remotely. Attacks of this nature are highly complex. The exploitability is assessed as difficult. The exploit has been released to the public and may be used for attacks.

Affected Software

2 affected components

open5gs open5gs=2.7.6

Event History

Mar 27, 2026

CVE Published

via MITRE·09:27 PM

Data Sourced

via MITRE·09:27 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·10:16 PM

DescriptionSeverityWeaknessAffected Software

Nov 28, 58273

Event

via FIRST·04:09 AM

Frequently Asked Questions

What is the severity of CVE-2026-4988?

CVE-2026-4988 has been classified as a denial of service vulnerability, which can significantly disrupt service availability.

How do I fix CVE-2026-4988?

To mitigate CVE-2026-4988, upgrade Open5GS to version 2.7.7 or higher, which addresses the vulnerability.

What component is affected by CVE-2026-4988?

CVE-2026-4988 affects the CCA Message Handler component, specifically the functions smf_gx_cca_cb, smf_gy_cca_cb, and smf_s6b.

Can CVE-2026-4988 be exploited remotely?

Yes, CVE-2026-4988 can be exploited remotely, making it critical to implement the recommended updates.

What versions of Open5GS are impacted by CVE-2026-4988?

CVE-2026-4988 specifically affects Open5GS version 2.7.6.