A flaw in Open5GS v2.7.7 and earlier resides in the shared NF‑Profile parser, specifically in the nnrf‑handler.c library. The bug allows an attacker to manipulate data such that the parser consumes excessive resources, eventually causing the service to crash or become unresponsive. The impact is a denial of service that can disrupt the operation of the NNGRF component and, by extension, the overall 5G core network.

The vulnerability affects Open5GS implementations up to version 2.7.7. No additional version information is supplied. The affected component is the Shared NF‑Profile Parser within the NNGRF service. Deployments running any of those versions that expose the NNGRF interface to external traffic are susceptible.

The CVSS score of 5.3 indicates moderate severity. No EPSS score is available, so an estimate of exploitation likelihood cannot be provided. The vulnerability is not listed in the CISA KEV database. It is inferred that the attack can be conducted remotely, as the description notes that the exploitation is possible from a remote location. An attacker could repeatedly trigger the denial of service by sending crafted requests to the NNGRF service until it exhausts resources or crashes.