Read the docs
TI-2025-42686 Aliases CVE-2025-69232

free5GC hasProtocol Compliance Violation in UPF Leading to SMF Service Disruption

Priority LOW 20CWE-20Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
None · None · Low
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

free5GC is an open-source project for 5th generation (5G) mobile core networks. free5GC go-upf versions up to and including 1.2.6, corresponding to free5gc smf up to and including 1.4.0, have an Improper Input Validation and Protocol Compliance vulnerability leading to Denial of Service. Remote attackers can disrupt core network functionality by sending a malformed PFCP Association Setup Request. The UPF incorrectly accepts it, entering an inconsistent state that causes subsequent legitimate requests to trigger SMF reconnection loops and service degradation. All deployments of free5GC using the UPF and SMF components may be affected. As of time of publication, a fix is in development but not yet available. No direct workaround is available at the application level. Applying the official patch, once released, is recommended.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00412 35th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
free5gcgo-upfup to 1.2.6—No fix listedCNA
free5gcsmfup to 1.4.0—No fix listedCNA
  • go-upf Vendorfree5gc Affected up to 1.2.6 Fixed in — No fix listed CNA
  • smf Vendorfree5gc Affected up to 1.4.0 Fixed in — No fix listed CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:free5gc:go-upf:*:*:*:*:*:go:*:*up to 1.2.6Vulnerablefree5gc
cpe:2.3:a:free5gc:smf:*:*:*:*:*:go:*:*up to 1.4.0Vulnerablefree5gc
  • cpe:2.3:a:free5gc:go-upf:*:*:*:*:*:go:*:* Versions up to 1.2.6 Vulnerable ·free5gc
  • cpe:2.3:a:free5gc:smf:*:*:*:*:*:go:*:* Versions up to 1.4.0 Vulnerable ·free5gc

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-69232

References

Exploit 1

Advisory 1

  • TI-2025-42700 free5GC has Heap Buffer Overflow in UPF Leading to Denial of Service CVSS 4.0LOW 2.7

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences