A vulnerability in the ogs_nas_parse_qos_rules function of the SMF component allows a remote attacker to manipulate the input in a way that causes a crash and a loss of service. The flaw is a use‑of‑uninitialized or mis‑parsed data condition (CWE‑404) that does not compromise confidentiality or integrity but shuts down the SMF process, leading to a denial of service for the affected network functions.

The affected product is Open5GS, version 2.7.7 and earlier. The vendors and products list indicates no specific vendor name, but the implementation is the open source Open5GS project. No other version details are provided.

The CVSS score of 5.3 rates the flaw as moderate severity. No EPSS score is available and the vulnerability is not listed in the CISA KEV catalog. The attack vector is remote and the exploit has been publicly disclosed, meaning that an attacker with network access to the SMF can trigger the crash without local privileges.