This vulnerability affects Open5GS up to version 2.7.7 in the NRF component, specifically in the /lib/sbi/message.c library. By manipulating the service-names/snssais argument, an attacker can cause a denial of service remotely. The vulnerability is confirmed public with an exploit available, but no official fix or mitigation has been released by the vendor. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges or user interaction required, and limited impact on availability.

Successful exploitation results in denial of service, potentially disrupting the affected Open5GS network function. The impact is limited to availability degradation without evidence of confidentiality or integrity compromise. The vulnerability can be triggered remotely without authentication, increasing the risk of service disruption in affected deployments.

No official patch or remediation is currently available from the vendor. Since the project has not responded or released a fix, users should monitor the Open5GS project for updates and consider implementing network-level protections to restrict access to the NRF component until a fix is provided. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.