A flaw in the pcf_nbsf_management_handle_register function of Open5GS’ sm-policies endpoint causes a denial of service through improper resource handling. The vulnerability matches CWE‑404 and allows an attacker to trigger unresponsiveness or crash of the API service, disrupting availability for all users of the affected Open5GS deployment.

Open5GS releases through version 2.7.7 are susceptible. The vulnerability is present in the src/pcf/nbsf-handler.c component of the sm‑policies endpoint and affects all installations that have not applied any workaround or patch after that point.

The CVSS score of 6.9 indicates a moderate impact level, and the publicly disclosed exploit means attackers can reach the vulnerable endpoint from the Internet. While the EPSS score is not available, the known public availability of the exploit and the absence from the CISA KEV catalog suggest the risk is still significant but not immediately trending upward. Potential exploitation requires remote access to the sm‑policies API; an attacker could repeatedly register NBSF services, exhausting resources and forcing a service outage.