Open5GS versions through 2.8.0 contain a reachable assertion in the function mme_gn_handle_sgsn_context_request(). When a GTPv1‑C packet is received from a configured SGSN address that includes a known UE IMSI or P‑TMSI, the implementation allows an attacker to supply an invalid SGS triggering the assertion and causing the MME process to crash. The crash terminates open5gs‑mmed and results in a denial of service for all subscribers. The vulnerability is exploitable by remote unauthenticated attackers who can craft the malformed packet. The impact is a service disruption at the network level for all users served by the affected MME.

The affected system is the Open5GS MME component, specifically all Open5GS releases up to and including version 2.8.0. The vulnerability resides in the mme_gn_handler.c source and affects any deployment that enables the handling of GTPv1‑C SGSN context requests.

The CVSS score of 8.2 classifies this as high severity, and the lack of an EPSS score indicates that no current estimation of exploitation probability is available, but the risk remains significant due to the remote, unauthenticated nature of the exploit. The vulnerability is not listed in the CISA KEV catalog, yet the ability to crash the MME with a single crafted packet makes it a realistic and urgent threat for operators. The attack requires only the ability to send GTPv1‑C traffic to the MME, which is typically a straightforward network‑level operation.