CVE-2026-8728: Open5GS NRF conv.c ogs_sbi_discovery_option_parse_plmn_list denial of service
A security vulnerability has been detected in Open5GS up to 2.7.7. The impacted element is the function ogssbidiscoveryoptionparseplmnlist in the library /lib/sbi/conv.c of the component NRF. Such manipulation of the argument target-plmn-list leads to denial of service. The attack can be executed remotely. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
Open5GS NRFfrom your environment.Stop or uninstall the Open5GS NRF component (take the NRF service offline) until a safe, patched release is available to prevent remote denial-of-service via crafted target-plmn-list arguments.
- Compensating control
Restrict network access to the NRF SBI/API interfaces using firewalls, security groups, ACLs or network segmentation. Allow access only from trusted management networks/IPs and block untrusted or Internet-origin traffic to the NRF.
- Operational
Increase monitoring and incident response readiness: collect NRF logs and crash dumps, watch for crashes or malformed target-plmn-list requests, and be prepared to apply vendor fixes when they are released. Treat public exploit disclosure as actionable and investigate any signs of exploitation.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-8728?
CVE-2026-8728 has been classified as a denial of service vulnerability.
How do I fix CVE-2026-8728?
To fix CVE-2026-8728, update Open5GS NRF to version 2.7.8 or later.
What component is affected by CVE-2026-8728?
CVE-2026-8728 affects the NRF component in Open5GS.
What specific function in CVE-2026-8728 is causing the vulnerability?
The vulnerability in CVE-2026-8728 is due to the ogs_sbi_discovery_option_parse_plmn_list function.
Which versions of Open5GS are impacted by CVE-2026-8728?
Open5GS versions up to and including 2.7.7 are impacted by CVE-2026-8728.