PT-2025-52286 · Free5Gc · Free5Gc Upf

Linziyuu · Published 2025-12-18 · Updated 2025-12-20 · CVE-2025-65562

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions free5GC UPF versions prior to 4.1.0

Description The free5GC UPF is susceptible to a denial of service due to insufficient bounds checking on the Session ID (SEID) when handling PFCP Session Deletion Requests. An unauthenticated remote attacker can exploit this by sending a request containing a large SEID value, such as 0xFFFFFFFFFFFFFFFF. This causes an integer conversion/underflow within the LocalNode.DeleteSess() and LocalNode.Sess() functions during the conversion of a uint64 SEID to an int, leading to a negative index when used in array access. This results in a Go runtime panic and a crash of the UPF component. The issue was reproduced on version 4.1.0, and other versions may also be affected. The vulnerable code is located in internal/pfcp/node.go.

Recommendations Update to a version of free5GC UPF later than 4.1.0.

Exploit

Fix

DoS

Improper Validation of Array Index

Weakness Enumeration

CWE-129

Related Identifiers

CVE-2025-65562

Affected Products

Free5Gc Upf

References · 5

• 🔥 https://github.com/free5gc/free5gc/issues/731 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-65562 · Security Note
• https://osv.dev/vulnerability/CVE-2025-65562 · Vendor Advisory
• https://twitter.com/VulmonFeeds/status/2001764601919086770 · Twitter Post
• https://twitter.com/CVEnew/status/2002487752034840962 · Twitter Post