The vulnerability lies in the complexQueryFilterSubprocess function of the NRF Discovery service in free5gc v4.0.1, where a crafted input can trigger an application crash and cause the service to become unavailable. The denial of service condition results from improper handling of invalid or unexpected query parameters, allowing an attacker to repeatedly disrupt service availability. The impact is limited to the NRF Discovery service.

free5gc v4.0.1, specifically the NRF Discovery component that implements the complexQueryFilterSubprocess function. The issue emanates from free5gc's open‑source codebase; no other vendors or products are listed as affected.

The CVSS score of 7.5 indicates a high severity, and the EPSS score of <1% suggests a very low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be remote, as the function processes network‑received query parameters. An attacker could exploit the issue by sending a maliciously crafted Query request to the NRF Discovery service, inducing a crash and exhausting system resources. While the exploit likely requires network access to the service endpoint, it does not appear to grant further privileges or cause data corruption. The lack of publicly available mitigation or patch references suggests that remediation may involve code updates or operational controls until a corrective patch is released.