A flaw in the AMF component of Open5GS permits an attacker to provide crafted input to the amf_nsmf_pdusession_handle_update_sm_context function, causing the AMF process to become unresponsive. The weakness is classified as CWE-404, a missing resource handling issue, leading directly to a loss of service availability for users depending on the 5G core network controls.

The vulnerability affects Open5GS deployments up through version 2.7.7. Any installation of Open5GS with the AMF module exposed to external networks may be impacted. The affected product is the Open5GS AMF service; exact subcomponent is the nsmf-handler.c file within the AMF module.

The CVSS score of 5.3 indicates a moderate severity denial‑of‑service condition. EPSS data is unavailable, so the exact likelihood of exploitation cannot be quantified; however, because the vulnerability can be triggered remotely, the attack surface remains high. The issue is not documented in CISA’s KEV catalog, suggesting no known active exploit kits yet, but the public disclosure and lack of vendor response raise concerns that attackers could craft custom attacks.