An error in the ngap_send_to_nas() function of Open5GS allows a remote attacker to trigger a crash of the AMF component, causing a denial of service. The flaw is exercised by sending a specially crafted NGAP message that is improperly handled during the conversion to NAS protocol. Authentication or elevated privileges are not required, so unauthenticated traffic can exploit the weakness. The result is a service outage that interrupts cellular connectivity for all users served by the affected AMF instance.

Open5GS version 2.7.0 contains the vulnerable ngap_send_to_nas() implementation. No other Open5GS releases are listed as affected in the advisory. Systems running earlier or later major releases (e.g., 2.6.x or 2.8.x) are not reported to be impacted.

The advisory does not provide a CVSS score, and the EPSS score is unavailable. The vulnerability is not listed in the CISA KEV catalog, indicating no known active exploitation at the time of this analysis. Nevertheless, the defect can be tapped by unauthenticated remote traffic, so any publicly reachable AMF is exposed to potential service disruption. Operators should treat this vulnerability as a serious risk, particularly for critical or emergency services.