CVE-2026-8730: Open5GS NRF context.c ogs_sbi_nf_instance_set_id denial of service
A flaw has been found in Open5GS up to 2.7.6. This impacts the function ogssbinfinstancesetid in the library /lib/sbi/context.c of the component NRF. Executing a manipulation of the argument nfInstanceId can lead to denial of service. The attack may be performed from remote. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Restrict network exposure of the Open5GS NRF service (component NRF). Apply firewall/ACL rules to limit access to SBI/management endpoints to trusted IPs or networks, and isolate the NRF from untrusted networks to reduce risk of remote exploitation.
- Operational
Monitor the Open5GS project and issue reports for a security patch or fixed release addressing the ogs_sbi_nf_instance_set_id flaw in /lib/sbi/context.c. When a vendor patch or fixed version is published, apply the patch or upgrade promptly. In the meantime, monitor logs and network traffic for indicators of exploitation of this published vulnerability.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-8730?
CVE-2026-8730 is classified as a denial of service vulnerability.
How do I fix CVE-2026-8730?
To fix CVE-2026-8730, upgrade Open5GS to version 2.8.0 or later.
What component is affected by CVE-2026-8730?
CVE-2026-8730 affects the NRF component in Open5GS.
What versions of Open5GS are impacted by CVE-2026-8730?
Open5GS versions up to and including 2.7.6 are impacted by CVE-2026-8730.
What function is associated with CVE-2026-8730?
CVE-2026-8730 is associated with the function ogs_sbi_nf_instance_set_id in the context.c library.