This vulnerability in Open5GS affects the HSS component's handling of the User-Name argument in the src/hss/hss-cx-path.c file. An attacker can remotely manipulate this argument to trigger a reachable assertion, potentially causing denial of service or disruption of service. The vulnerability affects all Open5GS versions from 2.0 through 2.8.0 inclusive. Although an exploit has been published, there is no indication of active exploitation in the wild. A patch has been identified but no official vendor advisory or remediation level is provided in the data.

The vulnerability allows remote attackers to cause a reachable assertion failure in the HSS component, which may lead to denial of service or service disruption. The CVSS 4.0 base score is 5.3 (medium), reflecting the remote attack vector with low complexity and no required privileges or user interaction. There is no evidence of confidentiality, integrity, or availability impact beyond the assertion failure.

A patch identified by commit c9abe09421eb99bbf1cd7862a3d375e58a4eb9e4 is recommended to fix this vulnerability. Patch status is not yet confirmed by an official vendor advisory; users should apply the patch as soon as possible and monitor vendor channels for official guidance.