This vulnerability in Open5GS (up to version 2.7.7) impacts the NRF component's subscription data and NF service addition functions. By exploiting a flaw in ogs_sbi_subscription_data_add and ogs_sbi_nf_service_add, an attacker with network access can remotely trigger a denial of service. The issue has been publicly disclosed, and a patch exists as referenced by the commit ID 819db11a08b9736a3576c4f99ceb28f7eb99523a. The CVSS 4.0 base score is 5.3, indicating medium severity, with attack vector network, low attack complexity, no privileges required, and no user interaction needed.

Successful exploitation results in denial of service of the Open5GS NRF component, potentially disrupting network function related to subscription data and NF service management. The vulnerability can be triggered remotely without authentication or user interaction, which increases risk. However, the impact is limited to denial of service without evidence of code execution or data compromise.

A patch identified by commit 819db11a08b9736a3576c4f99ceb28f7eb99523a is available and should be applied to affected Open5GS versions (2.7.0 through 2.7.7) to remediate this vulnerability. Since the product is not a cloud service, users must manually update their deployments. Patch status is confirmed by the presence of the patch commit. No vendor advisory content contradicts this guidance.