This vulnerability in Open5GS (up to version 2.7.7) involves the ogs_sbi_parse_plmn_list function within the NSSF component's /lib/sbi/conv.c library. Improper handling or manipulation of input data in this function can lead to a denial of service condition. The attack vector is remote network access, requiring no user interaction or elevated privileges. Although the vulnerability has been publicly disclosed, the Open5GS project has not yet issued a response or patch. The CVSS 4.0 base score is 5.3, indicating a medium severity level.

Successful exploitation results in denial of service, potentially disrupting the availability of the Open5GS network functions relying on the NSSF component. There is no indication of privilege escalation, data disclosure, or code execution. The vulnerability can be triggered remotely, which increases the risk of service disruption in affected deployments.

As of the current information, no official patch or remediation is available from the Open5GS project. Users should monitor the vendor's advisories for updates. In the absence of a patch, consider applying network-level protections such as filtering or rate limiting access to the affected service to reduce exposure. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.