Open5GS exposes a vulnerability in the ngap_send_to_nas() function that, when a specially crafted NGAP message is received, can cause the AMF process to crash. The resulting crash terminates the AMF service, leading to a denial of service that disrupts all cellular connections managed by the affected instance. This flaw involves a resource exhaustion issue (CWE‑401). The description does not specify whether the attacker must be authenticated or possess elevated privileges; thus, any entity able to send a valid NGAP message to the AMF could potentially trigger the crash.

Open5GS version 2.7.0 is the only release explicitly identified as vulnerable. No other releases are mentioned. The vulnerability exists in the ngap_send_to_nas() implementation in src/amf/ngap-path.c.

The CVSS score of 7.5 indicates a high severity impact. The EPSS score is reported as less than 1%, indicating a very low probability of exploitation under current conditions, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a remote attacker sending a malicious NGAP message to an AMF endpoint that is reachable over the network; authentication requirements are unknown based on the available information. While the low EPSS suggests current exploitation risk is low, the high impact of a service outage warrants prompt mitigation, especially for critical infrastructure or emergency communications.