free5gc v4.0.1 contains an error that allows a denial of service when malicious SUCI data is processed during user equipment registration. The flaw arises from an improper handling of SUCI fields, consistent with CWE‑770, leading to either crashes or resource exhaustion in the parsing subsystem. A successful exploitation would stop the registration process for the network, potentially making the core unavailable to legitimate subscribers.

The vulnerability is limited to the free5gc open‑source 5G core stack, specifically version 4.0.1. No other versions or product variants are known to be affected based on the current advisory.

The CVSS score of 7.5 indicates a high severity, while the EPSS score of less than 1 % signals a very low observed probability of exploitation. The vulnerability is not listed in the CISA KEV catalog, and no public exploits are available. Based on the description, it is inferred that the attack would be carried out remotely by injecting crafted SUCI data into the UE registration flow, but the lack of concrete proof means the attack path remains hypothetical.