This vulnerability affects Open5GS up to version 2.7.7 in the function ogs_pcc_rule_install_flow_from_media located in /lib/proto/types.c. An attacker can remotely manipulate this function to trigger a denial of service condition. The issue was responsibly reported to the project early, but no response or patch has been provided as of the publication date. The CVSS 4.0 base score is 6.9, indicating a medium severity with network attack vector, no privileges or user interaction required, and low impact on availability.

Successful exploitation results in denial of service, disrupting the availability of the Open5GS service. The vulnerability can be triggered remotely without authentication or user interaction. There is no indication of data confidentiality or integrity impact. The exploit code is publicly available, increasing the risk of attack, but no known active exploitation in the wild has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the Open5GS project has not responded or released a fix, users should monitor official channels for updates. In the meantime, consider implementing network-level protections such as filtering or rate limiting to reduce exposure to potential exploit attempts targeting this vulnerability.