A flaw exists in the Open5GS Session Management Function (SMF) component within the /src/smf/npcf-handler.c file, specifically in the update_authorized_pcc_rule_and_qos function. The defect allows a remote attacker to trigger a denial of service by manipulating the authorized packet‑correlation rules and QoS settings. When the function mismanages references, the SMF process terminates or freezes, resulting in a loss of service availability. The weakness is identified as CWE‑404, indicating a missing or improper reference handling issue.

All installations of Open5GS up to and including version 2.7.7 are affected. This includes deployments where the SMF module handles NpCf traffic for packet‑correlation rules management. No known fix exists in released versions through 2.7.7, and the maintainers have not yet published a patch evident in the provided references.

The CVSS score of 5.3 indicates medium severity, but the official details confirm remote exploitation is possible and an exploit has been published. Although the EPSS score is not available and the vulnerability is not listed in CISA’s KEV catalog, the presence of proof‑of‑concept code in public repositories suggests that the likelihood of exploitation may be higher than the base score implies. Operators should consider the risk notable, as an attacker could disrupt service availability on exposed Open5GS instances.