An input validation flaw combined with unchecked resource usage in Open5GS 2.7.3 permits a remote attacker to deliver a specially crafted PDU Session Modification Request that triggers a crash or makes the service unresponsive, leading to denial of service. The underlying weakness aligns with CWE‑20 (Improper Validation of Input) and CWE‑400 (Uncontrolled Resource Consumption).

Open5GS, the open‑source 5G core network implementation, is affected in release 2.7.3. Any deployment that has not upgraded beyond this version remains vulnerable until a fix is deployed.

The CVSS score of 7.5 reflects a high impact, with an EPSS score of less than 1 % indicating that widespread exploitation has not been documented. The vulnerability can be triggered from any external network that can reach the Open5GS instance, presumably through its user‑plane interface that accepts PDU Session Modification Requests; this attack vector is inferred from the description of a crafted network message. Because the flaw relies on malformed input, an attacker can repeat the exploit without authentication, potentially exhausting server resources until the node becomes unavailable.