The vulnerability resides in the mme_s11_handle_create_session_response function of Open5GS's MME component version 2.7.6. An attacker can manipulate responses to this function, triggering a resource exhaustion condition that causes the MME process to crash and result in a denial of service. The weakness is identified as a resource management flaw (CWE‑404).

The affected system is Open5GS MME version 2.7.6. No other vendors or product versions are currently impacted according to the available data.

The CVSS score of 6.9 indicates a moderate severity. The EPSS score of less than 1% suggests that the probability of this vulnerability being exploited in the wild is low, and the vulnerability is not currently listed in the CISA KEV catalog. However, the description confirms that an exploit has already been published and is potentially available for use. The attack can be launched remotely, implying that the attacker does not need local access. Given the moderate severity and the low exploitation likelihood, the overall risk is moderate but could be elevated if an attacker obtains access to the network segment that communicates with the MME's S11 interface.