Ericsson Packet Core Controller versions earlier than 1.39 are affected by a vulnerability that allows an attacker to send a large volume of specially crafted messages, resulting in service degradation. The weakness can overwhelm the controller, leading to reduced performance or temporary unavailability of network functions. Classed as CWE‑228, the flaw represents a failure to properly handle high‑volume traffic, which can cause denial or degradation of service rather than data loss or code execution.

The affected system is Ericsson Packet Core Controller (PCC) running any firmware version lower than 1.39. All deployments of PCC that have not upgraded beyond version 1.39 are susceptible to the described volume‑based exploitation.

The CVSS score of 7.1 indicates a high‑severity flaw, and the lack of an EPSS score means no publicly reported exploit prevalence is available. The vulnerability is not listed in CISA KEV, suggesting no pervasive exploitation has been documented yet, but its impact on availability is significant. The most likely attack vector is network‑based, inferred because the attacker must transmit crafted messages to the PCC. An adversary with network access or the ability to flood the controller can trigger the degradation without further privilege.