CVE-2026-8224 — Denial of Service

title: CVE-2026-8224 - Open5GS PCF IPv6 Prefix DoS
id: scw-2026-05-10-ai-1
status: experimental
level: high
description: |
  Detects attempts to exploit CVE-2026-8224 by targeting the pcf_sess_set_ipv6prefix function in Open5GS. The rule looks for specific URI paths and query parameters related to the manipulation of the SmPolicyContextData.ipv6AddressPrefix, which is the vector for the denial of service vulnerability. This is a critical detection for initial access via this specific vulnerability.
author: SCW Feed Engine (AI-generated)
date: 2026-05-10
references:
  - https://shimiscyberworld.com/posts/nvd-CVE-2026-8224/
tags:
  - attack.initial_access
  - attack.t1190
logsource:
    category: webserver
detection:
  selection:
      cs-uri|contains:
          - '/pcf/context.c'
      cs-uri-query|contains:
          - 'SmPolicyContextData.ipv6AddressPrefix='
      cs-method:
          - 'POST'
  condition: selection
falsepositives:
  - Legitimate administrative activity

Source: Shimi's Cyber World · License & reuse