A stored PFD‑subscription with an attacker‑controlled notifyUri causes the NEF service to terminate the entire process when the delivery attempt fails. The vulnerable code calls logger.PFDManageLog.Fatal(err) on any error, which is equivalent to os.Exit(1). The result of such an error is a deterministic crash of the NEF component, dropping the entire Service‑Based Interface surface until a restart occurs. This behavior is a denial‑of‑service flaw attributable to improper input validation (CWE‑20), insecure error handling (CWE‑617) and fatal exit on error (CWE‑755).

The flaw exists in versions of free5GC released before 4.2.2, affecting all deployments that use the NEF component of the free5GC open‑source 5G core network. Any instance running a pre‑4.2.2 release is vulnerable.

The CVSS score of 7.5 signals a high‑severity vulnerability. Although the EPSS score is not available, the lack of listing in the CISA KEV catalog suggests no widespread public exploitation at this time. Exploitation requires the ability to create a PFD subscription with an arbitrary notifyUri, which typically requires authentication and sufficient privileges to register subscriptions. Once an authorized user submits a malicious notifyUri and triggers a PFD change, the NEF process will crash in a repeatable manner. Based on the description, the attack vector is therefore remote and depends on the exposed NEF API surface and the credentials of the attacker.