A null pointer dereference flaw exists in the PGW S5U address handler of Open5GS, specifically in the session modification response processing. The vulnerability allows a remote attacker to send crafted network messages that trigger a crash of the affected component. The impact is service interruption, as the component will fail and potentially affect the entire network function. The flaw is rated 6.9 on the CVSS scale and is catalogued as CWE‑476 and CWE‑404.

All Open5GS deployments up to version 2.7.6 are affected. The vulnerability is present in the PGW service that handles S5U traffic and is triggered by the sgwc_sxa_handle_session_modification_response routine. This includes any publicly accessible instance that processes LTE or 5G bearer modification responses.

The EPSS score for this issue is below 1 %, indicating a low probability of exploitation, but public proof‑of‑concept code has been released and the exploit is actively available. Because the attack vector is remote and does not require local user interaction, it can be launched from outside the network. While the flaw does not grant code execution, it can still degrade network availability and may be used as part of a larger denial‑of‑service campaign. The vulnerability is not yet listed in the CISA KEV catalog.