A denial‑of‑service vulnerability exists in Open5GS versions up to 2.7.7. The bug is in the function ogs_sbi_discovery_option_parse_plmn_list within the NRF component’s /lib/sbi/conv.c module. By manipulating the target‑plmn‑list argument, an attacker can cause the NRF service to crash or become unresponsive. The vendor has documented this issue in public issue trackers, and the vulnerability can be exploited remotely, as the affected function is reachable over the network.

Open5GS (NRF component) with all releases up to and including 2.7.7 are impacted. No information about a fixed release is available, so any version up to and including 2.7.7 remains vulnerable.

The CVSS score of 5.3 indicates moderate severity. EPSS data is unavailable, so the likelihood of exploitation is unknown, and the vulnerability is not listed in CISA’s KEV catalog. The vulnerability is exploitable remotely by submitting crafted target‑plmn‑list data, leading to service interruption. Because the attack is remote and the impact is denial of service, the risk to uptime and availability is significant for operators relying on continuous NRF operation.