CVE-2026-4240

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-4240
A vulnerability was determined in Open5GS up to 2.7.6. The affected element is the function smf_gx_cca_cb/smf_gy_cca_cb/smf_s6b_aaa_cb/smf_s6b_sta_cb of the component CCA Handler. This manipulation causes denial of service. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. Upgrading to version 2.7.7 is sufficient to fix this issue. Patch name: 80eb484a6ab32968e755e628b70d1a9c64f012ec. Upgrading the affected component is recommended.

5.3 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact LOW

Scope UNCHANGED

5.0 /10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:L/Au:N/C:N/I:N/A:P

Exploitability : 10.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact PARTIAL

References
Link Resource
https://github.com/open5gs/open5gs/ Product
https://github.com/open5gs/open5gs/commit/80eb484a6ab32968e755e628b70d1a9c64f012ec Patch
https://github.com/open5gs/open5gs/issues/4343 Issue Tracking Third Party Advisory
https://github.com/open5gs/open5gs/issues/4343#issue-4021871895 Exploit Issue Tracking Third Party Advisory
https://github.com/open5gs/open5gs/releases/tag/v2.7.7 Release Notes
https://vuldb.com/?ctiid.351182 Permissions Required VDB Entry
https://vuldb.com/?id.351182 Third Party Advisory VDB Entry
https://vuldb.com/?submit.771361 Exploit Third Party Advisory VDB Entry
Configurations

Configuration 1 (hide)

cpe:2.3:a:open5gs:open5gs:*:*:*:*:*:*:*:*
History

20 Mar 2026, 18:15

Type Values Removed Values Added
CPE cpe:2.3:a:open5gs:open5gs:*:*:*:*:*:*:*:*
Summary
  • (es) Una vulnerabilidad fue determinada en Open5GS hasta 2.7.6. El elemento afectado es la función smf_gx_cca_cb/smf_gy_cca_cb/smf_s6b_aaa_cb/smf_s6b_sta_cb del componente Gestor CCA. Esta manipulación causa denegación de servicio. El ataque puede iniciarse remotamente. El exploit ha sido divulgado públicamente y puede ser utilizado. Actualizar a la versión 2.7.7 es suficiente para solucionar este problema. Nombre del parche: 80eb484a6ab32968e755e628b70d1a9c64f012ec. Se recomienda actualizar el componente afectado.
First Time Open5gs open5gs
Open5gs
References () https://github.com/open5gs/open5gs/ - () https://github.com/open5gs/open5gs/ - Product
References () https://github.com/open5gs/open5gs/commit/80eb484a6ab32968e755e628b70d1a9c64f012ec - () https://github.com/open5gs/open5gs/commit/80eb484a6ab32968e755e628b70d1a9c64f012ec - Patch
References () https://github.com/open5gs/open5gs/issues/4343 - () https://github.com/open5gs/open5gs/issues/4343 - Issue Tracking, Third Party Advisory
References () https://github.com/open5gs/open5gs/issues/4343#issue-4021871895 - () https://github.com/open5gs/open5gs/issues/4343#issue-4021871895 - Exploit, Issue Tracking, Third Party Advisory
References () https://github.com/open5gs/open5gs/releases/tag/v2.7.7 - () https://github.com/open5gs/open5gs/releases/tag/v2.7.7 - Release Notes
References () https://vuldb.com/?ctiid.351182 - () https://vuldb.com/?ctiid.351182 - Permissions Required, VDB Entry
References () https://vuldb.com/?id.351182 - () https://vuldb.com/?id.351182 - Third Party Advisory, VDB Entry
References () https://vuldb.com/?submit.771361 - () https://vuldb.com/?submit.771361 - Exploit, Third Party Advisory, VDB Entry

16 Mar 2026, 14:20

Type Values Removed Values Added
New CVE
Information

Published : 2026-03-16 14:20

Updated : 2026-03-20 18:15

NVD link : CVE-2026-4240

Mitre link : CVE-2026-4240

CVE.ORG link : CVE-2026-4240

JSON object : View

Products Affected

open5gs

  • open5gs
CWE
CWE-404

Improper Resource Shutdown or Release