The vulnerability originates in the ResolveNodeIdToIp function within the SMF component of Free5GC versions up to 4.1.0. By supplying crafted input, an attacker can trigger a denial of service that prevents the SMF from processing subsequent requests. The flaw involves unchecked resource handling and is classified as CWE-404. The result is loss of service for the SMF and the control plane services it supports.

Affected systems include deployments of the Free5GC open‑source 5G core network stack, specifically releases up to and including 4.1.0. The vulnerability resides in the internal/sbi/processor/datapath.go file of the SMF component. Users running any version earlier than 4.1.1 should consider the system vulnerable. No specific platform or OS constraints are indicated.

The CVSS score of 6.9 indicates moderate severity and the EPSS score of less than 1% suggests a low probability of exploitation, though a publicly available exploit script can cause a denial of service. Attackers can remotely target the SMF over the network, and prior evidence shows that the issue can be triggered without authentication. While not listed in CISA's KEV catalog, a loss of SMF availability can disrupt subscriber sessions and overall network performance, making it a high‑impact threat for operators.