TI-2025-13834 Aliases CVE-2025-15156 GHSA-4x7j-66xr-jfqf

NULL pointer dereference in omec-project UPF

MEDIUM 63CWE-404Published 2025-12-28 · Updated 2025-12-29

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Attack requirements: None
Impact type: Denial of service
Confidentiality · integrity · availability: None · None · Low
Fix status: No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-404.

Summary

A flaw has been found in omec-project UPF up to 2.1.3-dev. This affects the function handleSessionEstablishmentRequest of the file /pfcpiface/pfcpiface/messages_session.go of the component PFCP Session Establishment Request Handler. This manipulation causes null pointer dereference. The attack may be initiated remotely. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00322 25th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by the CNA

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: Yes
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
omec-project	UPF	2.1.3-dev	—	No fix listed	CNA

UPF Vendoromec-project Affected 2.1.3-dev Fixed in — No fix listed CNA

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2025-15156
2026-10-03 Alias added: GHSA-4x7j-66xr-jfqf

References

Exploit 1

https://github.com/omec-project/upf/issues/979

TI-2026-07720 omec-project amf NGAP Message handler.go null pointer dereference CVSS 4.0MEDIUM 5.3
TI-2026-12321 omec-project amf NGSetupRequest handler.go denial of service CVSS 4.0MEDIUM 5.3
TI-2026-12320 omec-project amf NGAP Message RRCInactiveTransitionReport denial of service CVSS 4.0MEDIUM 5.3
TI-2026-08167 omec-project amf NGReset Message memory corruption CVSS 4.0MEDIUM 5.3
TI-2026-08166 omec-project amf NGSetupRequest memory corruption CVSS 4.0MEDIUM 5.3
TI-2026-08164 omec-project amf PathSwitchRequest memory corruption CVSS 4.0MEDIUM 5.3

See all 12 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences