Denial of Service Vulnerability in free5GC UPF by free5GC
CVE-2025-65562

7.5HIGH

Key Information:

Vendor

free5GC

Status
free5GC UPF
Vendor
CVE Published:
18 December 2025

What is CVE-2025-65562?

The free5GC User Plane Function (UPF) is vulnerable due to insufficient bounds checking on the Session Endpoint Identifier (SEID) when handling PFCP Session Deletion Requests. This issue allows an unauthenticated remote attacker to send specially crafted requests with an excessively large SEID, leading to an integer underflow during the conversion from uint64 to an integer type. As a result, this can cause a negative index reference in the session processing logic, ultimately triggering a Go runtime panic that causes the UPF to crash. The problem has been confirmed in free5GC v4.1.0, with indications that other versions may also be susceptible. Immediate attention is recommended to mitigate potential denial of service scenarios.

References

https://github.com/free5gc/free5gc/issues/731

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.