PT-2026-25744 · Git+1 · Open5Gs

Ziyulin · Published 2026-03-16 · Updated 2026-03-17 · CVE-2026-4240

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Open5GS versions up to 2.7.6

Description A flaw exists in Open5GS that can lead to a denial of service. The issue is located within the smf gx cca cb/smf gy cca cb/smf s6b aaa cb/smf s6b sta cb function of the CCA Handler component. This manipulation can be initiated remotely. The exploit for this issue has been publicly disclosed.

Recommendations Upgrade to version 2.7.7 to resolve this issue.

Exploit

Fix

DoS

Improper Resource Release

Weakness Enumeration

CWE-404

Related Identifiers

CVE-2026-4240

Affected Products

Open5Gs

References · 12

• 🔥 https://github.com/open5gs/open5gs/issues/4343#issue-4021871895 · Exploit
• 🔥 https://vuldb.com/?submit.771361 · Exploit
• https://github.com/open5gs/open5gs/releases/tag/v2.7.7 · Patch
• https://github.com/open5gs/open5gs/commit/80eb484a6ab32968e755e628b70d1a9c64f012ec · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-4240 · Security Note
• https://osv.dev/vulnerability/CVE-2026-4240 · Vendor Advisory
• https://github.com/open5gs/open5gs/issues/4343 · Note
• https://twitter.com/CVEnew/status/2033583636940050498 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2033697281157783689 · Twitter Post
• https://github.com/open5gs/open5gs · Note
• https://vuldb.com/?ctiid.351182 · Note
• https://vuldb.com/?id.351182 · Note