The vulnerability involves a memory exhaustion flaw within the Open5GS v2.8.0 HTTP/2 SBI server. When an unauthenticated remote client sends crafted HTTP/2 requests that contain duplicate header names, the server leaks previously allocated header strings. This injection ultimately leads to persistent heap growth as the attacker can repetitively trigger thousands of duplicate headers with a small payload.

Affected systems are installations of Open5GS version 2.8.0 and earlier patches that did not incorporate the fix found in commit 76f15375 (github.com/open5gs/open5gs/commit/76f15375). The issue resides specifically in the HTTP/2 Service‑Based Interface component that handles HPACK compression of incoming requests.

Given that the exploit requires only unauthenticated HTTP/2 traffic and no special privileges, the attack vector is straightforward. While no CVSS score is publicly available, the memory depletion can culminate in process termination and a denial of service. The EPSS score is unavailable and the vulnerability is not yet listed in CISA’s KEV catalog, but the potential impact warrants immediate attention.