CVE-2026-4240 Open5GS CCA smf_s6b_sta_cb denial of service

What is CVE-2026-4240?

CVE-2026-4240 is a medium-severity vulnerability in Open5gs Open5gs, published on 16 Mar 2026.

Official description

A vulnerability was determined in Open5GS up to 2.7.6. The affected element is the function smf_gx_cca_cb/smf_gy_cca_cb/smf_s6b_aaa_cb/smf_s6b_sta_cb of the component CCA Handler. This manipulation causes denial of service. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. Upgrading to version 2.7.7 is sufficient to fix this issue. Patch name: 80eb484a6ab32968e755e628b70d1a9c64f012ec. Upgrading the affected component is recommended.

Weakness: CWE-404

Which versions are affected by CVE-2026-4240?

It affects 1 product.

Products include Open5gs Open5gs.

How do I fix CVE-2026-4240?

No fix has been published for CVE-2026-4240 yet. Limit exposure of the affected software until one is available.

Is CVE-2026-4240 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-4240 exists.

Other vulnerabilities in Open5gs Open5gs

• CVE-2024-40130 Memory corruption in n/a Critical 9.8
• CVE-2021-28122 Missing authorization in n/a Critical 9.8
• CVE-2021-25863 Hardcoded credentials in n/a High 8.8
• CVE-2025-41067 Reachable Assertion vulnerability in Open5GS High 8.7
• CVE-2025-41068 Reachable Assertion vulnerability in Open5GS High 8.7

All Open5gs Open5gs vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-wq9j-47c8-8fpr.