The vulnerability in open5GS version 2.8.0 permits an attacker who can send PFCP messages to exhaust transaction resources. The code fails to check the return value of ogs_pfcp_xact_remote_create() and later triggers an assertion that crashes the process with SIGABRT. The result is a denial of service that stops the SMF/UPF from handling new sessions until the component is restarted.

Affected systems are deployments of the open5GS open source 5G core network that run the SMF or UPF components with the 2.8.0 release. No other versions or vendors were identified in the CNA data.

The vulnerability is exploitable by any actor who can reach the SMF/UPF PFCP interface, which is typically reachable over an internal network. The lack of an EPSS score or KEV listing means the current exploitation likelihood is unknown, but the CVSS score is not provided, so risk assessment relies on the described denial‑of‑service impact. The attack path involves sending crafted PFCP messages to drain transaction or timer pools, allowing the attacker to induce a crash without special privileges on the target system.