A flaw was discovered in Open5GS, affecting all releases up to and including 2.7.7, within the delete Endpoint handler pcf_npcf_smpolicycontrol_handle_delete in src/pcf/sm-sm.c. The bug can be triggered by a crafted request, causing the Open5GS service to crash or become unresponsive, thereby denying service to legitimate users. The vulnerability is identified as CWE‑404, emphasizing improper cleanup or resource management leading to service interruption. The impact is a loss of availability for the affected network functions.

The affected product is Open5GS from the Open5GS organization. All releases up to 2.7.7 are susceptible; later releases are presumed to contain a fix. The specific component involved is the delete Endpoint handling within the PCF module.

The CVSS score of 6.9 categorizes this issue as a moderate severity vulnerability. The EPSS score is not available, and the vulnerability is not listed in CISA's KEV catalog, indicating that it has not yet been widely reported as exploited in the wild. The attack vector is remote, as an external actor can send a malicious request over the network to trigger the denial of service. The exploit is publicly documented and available, suggesting that an attacker could readily leverage it if the system remains unpatched.