This vulnerability exists in Open5GS up to version 2.7.7 within the amf_namf_callback_handle_sdm_data_change_notify function of the AMF SBI Endpoint. The flaw allows remote attackers to cause a denial of service by manipulating the changeItem.newValue argument in the /namf-callback/v1/{id}/sdmsubscription-notify API endpoint. The issue was responsibly disclosed but remains unpatched as of the latest information. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges or user interaction required, and low impact on availability.

Successful exploitation results in denial of service of the affected Open5GS AMF SBI Endpoint, potentially disrupting 5G core network functions relying on this component. The impact is limited to service availability with no indication of confidentiality or integrity compromise. The exploit is publicly available, increasing the risk of attempted attacks.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the project has not responded or released a fix, organizations should monitor for updates from the Open5GS project. In the meantime, consider applying network-level protections such as restricting access to the affected API endpoint to trusted sources only.