A flaw in the Open5GS project, specifically within the ogs_pool_id_calloc function of the nghttp2-server.c component, can be triggered by crafted input to cause a denial of service. The weakness is classified as a resource exhaustion vulnerability (CWE‑404) and does not provide an attacker with direct access to confidential data or the ability to modify system integrity; it only disrupts the availability of the affected service.

The vulnerability affects Open5GS installations up to and including version 2.7.7. No other vendors or product lines are listed as impacted in this advisory.

The CVSS base score is 5.3, indicating a moderate severity level. The EPSS score is not available, and the issue is not listed in the CISA KEV catalog. Attackers can launch the exploit remotely, and an exploit has already been made publicly available, suggesting that anyone with network reach to the vulnerable system could potentially interrupt service.