OMEC UPF pfcpiface CVE-2025-65567
HIGHAttack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach N4/PFCP endpoint
-
DeliveryEstablish PFCP association
-
ExploitSend Session Establishment Request with malformed Flow-Description
-
ExecutionTrigger out-of-bounds read in parseFlowDesc
-
PersistPanic crashes UPF process
-
ImpactRepeat to sustain denial of service
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, read limits
MITRE ATT&CK
1 technique across 1 tactic: Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires (1) network reachability to the UPF's N4/PFCP endpoint and (2) a prior PFCP association, after which a single PFCP Session Establishment Request carrying a CreatePDR with a malformed Flow-Description triggers the crash in parseFlowDesc. No user interaction and no authentication are needed (PFCP association itself is unauthenticated), so against a reachable endpoint this works on default configurations of upf-epc-pfcpiface 2.1.3-dev. The principal limiting factor is deployment topology: the N4 interface is normally isolated on the operator's internal 5G control-plane network rather than internet-exposed, so an attacker must already have a foothold on or spoofing access to that segment; the issue is confined to the stated 2.1.3-dev build. |
| Impact | All signals converge on a genuine but bounded availability threat. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, score 7.5) describes an unauthenticated, low-complexity, network-reachable attack with pure availability impact - consistent with the out-of-bounds read (CWE-125) in parseFlowDesc that panics and kills the UPF process. Publicly available exploit material exists in the form of the omec-project GitHub issue (#959), so a working trigger is documented, but this is NOT in CISA KEV and no EPSS score was supplied, so there is no evidence of active or widespread exploitation - treat POC availability and active exploitation as distinct. The key tempering factor the raw CVSS score hides is network positioning: PFCP/N4 is a 5G control-plane interface normally confined to the operator's internal core network between the SMF and UPF, not internet-exposed, so 'AV:N' here means reachable on the N4 segment rather than from the open internet. Net assessment: a real, prioritize-for-patching availability bug for anyone running this exact dev build, but the real-world blast radius depends heavily on whether the N4 interface is properly segmented; it is not a mass-exploitable internet-facing issue. The 'Information Disclosure' tag conflicts with the C:N vector and the DoS-only description and should be disregarded. |
| Exploit ScenarioDerived | An attacker with reachability to the UPF's N4/PFCP endpoint (e.g. a compromised or rogue host on the 5G control-plane network, or a malicious/spoofed SMF) establishes a PFCP association, then sends a PFCP Session Establishment Request containing a CreatePDR with a malformed Flow-Description. The parser reads beyond the buffer bounds and panics, terminating the UPF; the attacker simply replays the request to crash it repeatedly and deny user-plane service. A public reproduction is documented in the omec-project upf issue tracker (#959). |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 13, 2026
Denial of service in the OMEC project UPF pfcpiface build upf-epc-pfcpiface:2.1.3-dev: once a PFCP association is established, a single PFCP Session Establishment Request whose CreatePDR carries a malformed Flow-Description is not robustly validated, and parseFlowDesc reads past the end of the supplied buffer, triggering a panic that terminates the UPF process. The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H describes an unauthenticated remote attacker who, with network reachability to the N4/PFCP endpoint, can repeat the message to crash the UPF at will; publicly available exploit code exists via the upstream GitHub issue tracker, while no KEV listing or confirmed active exploitation is indicated. Practical impact is bounded by topology, since N4 normally sits on an operator's internal 5G control-plane network rather than being internet-exposed, but any deployment where that segment is reachable or insufficiently segmented faces a sustained availability risk.
RemediationAI
No vendor-released patch identified at time of analysis: the supplied data contains no fix version, commit, or patched release, so the immediate action is to monitor the upstream issue https://github.com/omec-project/upf/issues/959 (and the project's release notes) and apply the patched build as soon as one is published. In the interim, the most effective control is to restrict the N4/PFCP endpoint - PFCP conventionally uses UDP port 8805 - with host- and network-level ACLs so only the legitimate SMF addresses can send Session Establishment Requests; the trade-off is that an incorrect source-address list blocks all legitimate PFCP signalling, so validate the SMF addresses before deployment. Equally important is placing the N4 interface on a dedicated, isolated control-plane segment or VLAN so that an attacker must already hold a foothold on that internal network; this requires topology and firewall changes and may not be feasible in flat lab environments. Run the UPF under a process supervisor (systemd with Restart=always, or a container orchestrator restart policy) to shorten the outage window caused by repeated panics, accepting that state is lost on each restart and availability is not truly preserved. Where PFCP traffic can be inspected, front the UPF with a firewall, IDS/IPS, or a lightweight PFCP-aware filter that drops Session Establishment Requests carrying structurally invalid Flow-Description IEs; this shifts parsing and evasion risk to the intermediary and may cause false positives that discard valid sessions, so it should be tested against normal SMF traffic before enforcement. Disabling or firewalling PFCP entirely is only viable where the UPF is not in production use, since it prevents session establishment outright.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
PFCP (Packet Forwarding Control Protocol, 3GPP TS 29.244) is the control-plane protocol used over the N4 reference point between the SMF and the UPF in 5G core networks, and the affected component is the PFCP interface implementation (pfcpiface) in the OMEC project UPF, identified by CPE cpe:2.3:a:opennetworking:upf:2.1.3:dev. A Session Establishment Request carries one or more Packet Detection Rules (CreatePDRs) whose Flow-Description information element encodes IP filter rules; the parseFlowDesc routine in the pfcpiface converts that text into internal match criteria. The root cause is CWE-125 (out-of-bounds read): the parser does not constrain reads to the length of the supplied buffer when handling a malformed Flow-Description, so it consumes bytes beyond the end of the allocated data. In a Go implementation such as this UPF, an unrecovered slice/index fault raises a panic that unwinds and terminates the process, which is what converts a memory-safety bug into a hard availability failure; each subsequent crafted request can restart the crash cycle after the process is brought back up.
Know when Upf gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
PFCP association and the crash request need no authentication (PR:N) over the network (AV:N) with a reliably reproducible single message (AC:L); impact is availability-only process crash (A:H, C:N/I:N).
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
DescriptionCVE.org
A denial-of-service vulnerability exists in the omec-project UPF (pfcpiface component) in version upf-epc-pfcpiface:2.1.3-dev. After PFCP association, a specially crafted PFCP Session Establishment Request with a CreatePDR that contains a malformed Flow-Description is not robustly validated. The Flow-Description parser (parseFlowDesc) can read beyond the bounds of the provided buffer, causing a panic and terminating the UPF process. An attacker who can send PFCP Session Establishment Request messages to the UPF's N4/PFCP endpoint can exploit this issue to repeatedly crash the UPF.
Executive ViewAI
The open-source OMEC 5G User Plane Function container upf-epc-pfcpiface:2.1.3-dev can be remotely crashed by a single malformed PFCP session-establishment message, and publicly available exploit code exists. Because a crash of the UPF interrupts subscriber data-plane traffic for every user served by that instance, the exposure is primarily one of service availability and customer experience rather than data confidentiality or integrity. Leadership should care because the vulnerable endpoint sits on the internal N4 control-plane segment; environments where that segment is reachable by unauthorized parties or is poorly segmented face repeated, attacker-controlled outages until a fix is released.
No vendor-released patch identified at time of analysis. Interim mitigations: strictly segment and ACL the N4/PFCP interface so only trusted SMF peers can reach UDP 8805, disable any internet or cross-tenant exposure of that segment, apply PFCP message rate limiting and malformed-payload filtering at the boundary, and deploy automated UPF health-check supervision with fast restart to limit outage duration.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Affected Products (CPE)CVE.org
Remote denial-of-service in the omec-project UPF (pfcpiface component, version upf-epc-pfcpiface 2.1.3-dev) lets any end
Malformed PFCP Session Report Response messages delivered to the OMEC UPF's N4 endpoint cause the pfcpiface session-repo
Denial of service in the omec-project UPF's pfcpiface component (build 2.1.3-dev) allows remote attackers to crash the U
Remote unauthenticated attackers can crash the OMEC UPF 2.1.3-dev process by sending a PFCP Association Setup Request th
Malformed PFCP Association Setup Request messages crash the OMEC UPF (upf-epc/pfcpiface) by dereferencing a nil NodeID p
Buffer Overflow vulnerability in free5gc 3.3.0, UPF 1.2.0, and SMF 1.2.0 allows attackers to cause a denial of service v
Exploit-DB