This vulnerability exists in Open5GS, an open-source 5G core network implementation, specifically in the SMF component's gsm_build_pdu_session_establishment_accept function located in /src/smf/gsm-build.c. The flaw allows remote attackers to manipulate the function to trigger a denial of service condition. The issue affects all versions from 2.7.0 through 2.7.7. Although the vulnerability was reported early, the project has not yet issued a fix or official response. The CVSS 4.0 base score is 5.3, indicating a medium severity with network attack vector, low attack complexity, and no privileges or user interaction required.

Successful exploitation results in denial of service of the SMF component in Open5GS, potentially disrupting 5G core network session establishment. The vulnerability can be triggered remotely without authentication or user interaction. The availability of a public exploit increases the risk of active exploitation, although no known exploits in the wild have been reported so far.

As of the current information, no official patch or remediation is available from the Open5GS project. Users should monitor the vendor/project advisories for updates and consider implementing network-level protections to limit exposure of the SMF component to untrusted networks. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.