A flaw in the gsm_handle_pdu_session_modification_qos_flow_descriptions function of Open5GS version 2.7.7 and earlier allows a remote attacker to manipulate the n1SmMsg argument. By sending a crafted N1 SM message, the SMF can be forced into an uncontrolled loop or resource exhaustion, causing a denial of service. The weakness arises from improper handling of the N1 SM payload, corresponding to CWE-404.

The vulnerability affects the Open5GS project, specifically the Signaling Management Function (SMF) component. All releases up to version 2.7.7 are susceptible. No patch is available yet, but the fix is pending in a pull request. Users running these versions should be aware of the risk until a corrected release is issued.

The CVSS score of 5.3 indicates a medium severity, but because the attack can be carried out remotely and the exploit has been publicly disclosed, the risk is non‑negligible. The EPSS score is not provided, and the vulnerability is not yet listed in the CISA KEV catalog. Attackers would need the ability to inject malicious N1 SM messages into the SMF control plane, which can be achieved from external networks or compromised components that talk to the SMF.