The vulnerability CVE-2026-8251 exists in Open5GS up to version 2.7.7 within the SMF component, specifically in the update_authorized_pcc_rule_and_qos function located in /src/smf/npcf-handler.c. An attacker can remotely manipulate this function to trigger a denial of service condition. The vulnerability has been publicly disclosed and an exploit is available, but the vendor has not yet provided an official fix or mitigation guidance.

Successful exploitation results in denial of service of the affected Open5GS SMF component, potentially disrupting network functions relying on this software. The attack can be performed remotely without user interaction and requires low attack complexity and privileges. There is no indication of data confidentiality or integrity impact. No known exploits are reported in the wild beyond the public exploit disclosure.

No official patch or remediation is currently available from the vendor. Users should monitor the Open5GS project for updates and advisories. Until a fix is released, consider limiting exposure of the affected SMF service to untrusted networks and applying network-level protections to reduce attack surface. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.