A flaw in the Open5GS 2.7.7 or earlier library /lib/sbi/client.c in the NRF component allows an attacker to manipulate the client_pool argument to the ogs_sbi_client_add function, causing a crash that results in a denial of service. The vulnerability is classified as CWE-404 due to a missing error handling routine that fails to validate the supplied input. If exploited, the affected service would become unavailable to legitimate users, potentially disrupting network services reliant on the NRF.

Open5GS deployments built with versions up through 2.7.7 are affected. The flaw resides in the NRF module and specifically in the ogs_sbi_client_add routine within the client library. No specific operating system or platform is enforced by the flaw, making any host running the vulnerable Open5GS release a potential target.

The CVSS score of 5.3 indicates a moderate severity impact. No EPSS score is available, but the vulnerability has been disclosed publicly and is listed as not in the CISA KEV database. The description confirms that exploitation can originate remotely, implying that an attacker needs network connectivity to the NRF service. While the flaw is not highly urgent, the lack of immediate patch availability means the denial of service risk remains until a fix is released. In the absence of a patch, the vulnerability requires mitigation by restricting remote access to the NRF service and monitoring for anomalous traffic.