CVE-2025-69232
Improper Input Validation in free5GC UPF Causes DoS
Publication date: 2026-02-23
Last updated on: 2026-02-25
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| free5gc | go-upf | to 1.2.6 (inc) |
| free5gc | smf | to 1.4.0 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-20 | The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
The vulnerability exists in free5GC, an open-source project for 5G mobile core networks, specifically in the go-upf versions up to 1.2.6 and smf versions up to 1.4.0.
It is caused by improper input validation and protocol compliance in the UPF component. Remote attackers can send a malformed PFCP Association Setup Request that the UPF incorrectly accepts.
This causes the UPF to enter an inconsistent state, which leads to subsequent legitimate requests triggering SMF reconnection loops and service degradation, resulting in a Denial of Service.
There is currently no direct workaround at the application level, but a fix is in development and applying the official patch once released is recommended.
How can this vulnerability impact me? :
This vulnerability can disrupt the core network functionality of 5G mobile networks using free5GC UPF and SMF components.
An attacker can cause Denial of Service by sending malformed requests, leading to service degradation and reconnection loops in the network.
This can affect availability and reliability of the mobile network services relying on these components.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
I don't know
What immediate steps should I take to mitigate this vulnerability?
As of the time of publication, no direct workaround is available at the application level.
It is recommended to apply the official patch once it is released to fix the vulnerability.