This vulnerability in Open5GS (up to version 2.7.7) involves the SMF component's gsm_build_pdu_session_establishment_accept function, where crafted input can cause a denial of service condition. The attack vector is remote network access with no required privileges or user interaction. The vulnerability was responsibly disclosed but remains unaddressed by the vendor. The CVSS 4.0 base score is 5.3, reflecting medium severity with network attack vector and low complexity.

Successful exploitation results in denial of service, potentially disrupting the affected Open5GS SMF component's ability to process PDU session establishment accept messages. This could impact network service availability. No evidence of privilege escalation, data confidentiality, or integrity impact is indicated. The exploit is publicly available, increasing the risk of opportunistic attacks.

No official patch or remediation is currently available from the vendor. Patch status is not yet confirmed — check the Open5GS project advisory or repository for updates. Until a fix is released, consider applying network-level protections to limit exposure of the SMF component to untrusted networks and monitor for unusual traffic patterns targeting PDU session establishment.