Denial-of-Service Vulnerability in omec-project UPF by omec-project

CVE-2025-65563

What is CVE-2025-65563?

A denial-of-service vulnerability exists in the omec-project UPF component (upf-epc/pfcpiface) prior to version 2.1.3-dev. This issue arises when the UPF receives a PFCP Association Setup Request that lacks the mandatory NodeID Information Element. Instead of validating the message, the association setup handler attempts to dereference a nil pointer, resulting in a panic that causes the UPF process to crash. An attacker capable of sending PFCP Association Setup Request messages to the UPF's N4/PFCP endpoint can exploit this vulnerability to repeatedly crash the UPF, severely disrupting user-plane services.

References