This vulnerability in Open5GS up to version 2.7.7 involves improper handling of the supi_id argument in the ogs_dbi_subscription_data function of the UDR component's subscription.c library. Exploiting this flaw can cause a denial of service condition remotely. The vulnerability was reported early to the project, but no response or fix has been issued. The CVSS 4.0 base score is 5.3, indicating medium severity with network attack vector, low attack complexity, no privileges or user interaction required, and limited impact on availability.

Successful exploitation results in denial of service of the affected Open5GS UDR component, potentially disrupting service availability. There is no indication of data confidentiality or integrity impact. The vulnerability can be triggered remotely without authentication or user interaction, increasing the risk of service disruption. No known exploits in the wild have been reported.

As of the current information, no official patch or fix is available from the vendor. Users should monitor the Open5GS project for updates or advisories regarding this vulnerability. Until a fix is released, consider implementing network-level protections such as filtering or rate limiting requests targeting the UDR component to reduce exposure. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.