This vulnerability exists in the ogs_nas_parse_qos_rules function of the SMF component in Open5GS versions 2.7.0 through 2.7.7. An attacker can remotely manipulate inputs to trigger a denial of service condition. The CVSS 4.0 base score is 5.3 (medium severity) with attack vector network, low attack complexity, no privileges or user interaction required, and limited impact on availability. The vulnerability was publicly disclosed and reported to the project early, but no remediation or patch has been provided as of the publication date.

Successful exploitation results in denial of service of the affected Open5GS SMF component, potentially disrupting service. There is no indication of data confidentiality or integrity impact. The vulnerability can be triggered remotely without authentication, increasing the risk of service disruption in affected deployments.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch has been released and the project has not responded, users should monitor vendor channels for updates. Until a fix is available, consider applying network-level protections to restrict access to the vulnerable component and limit exposure to untrusted networks.