This vulnerability in Open5GS (up to version 2.7.7) involves the ogs_sbi_stream_find_by_id function in the NSSF component's nghttp2-server.c library. A local attacker can manipulate inputs to trigger a denial of service condition. The vulnerability requires local privileges to exploit and does not involve user interaction or network vector exploitation. The project was notified early but has not released a patch or mitigation. The CVSS 4.0 base score is 4.8, reflecting medium severity with local attack vector and low complexity.

Successful exploitation results in denial of service of the affected Open5GS component, potentially disrupting network functions relying on the NSSF. The attack requires local access, limiting remote exploitation risk. No data confidentiality or integrity impacts are described. The availability impact is limited to service disruption.

No official patch or remediation is currently available from the vendor. Since the vulnerability requires local access, restricting local user privileges and access to the affected system can reduce risk. Monitor vendor advisories for updates and apply patches promptly once released. Avoid running vulnerable versions in environments where untrusted local users have access.