CVE-2025-65566

A denial-of-service vulnerability exists in the omec-project UPF (pfcpiface component) in version upf-epc-pfcpiface:2.1.3-dev. When the UPF receives a PFCP Session Report Response that is missing the mandatory Cause Information Element, the session report handler dereferences a nil pointer instead of rejecting the malformed message. This triggers a panic and terminates the UPF process. An attacker who can send PFCP Session Report Response messages to the UPF's N4/PFCP endpoint can exploit this flaw to repeatedly crash the UPF and disrupt user-plane services.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/omec-project/upf/issues/958	Exploit Issue Tracking Patch
https://github.com/omec-project/upf/issues/958	Exploit Issue Tracking Patch

Configurations

Configuration 1 (hide)

cpe:2.3:a:linuxfoundation:upf:2.1.3:dev:*:*:*:*:*:*

History

13 Oct 2026, 11:10

Type	Values Removed	Values Added
Summary		(es) Una vulnerabilidad de denegación de servicio existe en el UPF del proyecto omec (componente pfcpiface) en la versión upf-epc-pfcpiface:2.1.3-dev. Cuando el UPF recibe una respuesta de informe de sesión PFCP a la que le falta el elemento de información de causa obligatorio, el gestor de informes de sesión desreferencia un puntero nulo en lugar de rechazar el mensaje malformado. Esto desencadena un pánico y termina el proceso del UPF. Un atacante que puede enviar mensajes de respuesta de informe de sesión PFCP al punto final N4/PFCP del UPF puede explotar esta falla para bloquear repetidamente el UPF y perturbar los servicios del plano de usuario.

Information

Published : 2025-12-18 20:16

Updated : 2026-10-13 11:10

NVD link : CVE-2025-65566

Mitre link : CVE-2025-65566

CVE.ORG link : CVE-2025-65566

JSON object : View

Products Affected

linuxfoundation

upf

CWE

CWE-476

NULL Pointer Dereference

{"id": "CVE-2025-65566", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-65566", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-12-19T17:25:36.746529Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "affected": [{"source": "cve@mitre.org", "affectedData": [{"vendor": "n/a", "product": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}]}], "published": "2025-12-18T20:16:07.647", "references": [{"url": "https://github.com/omec-project/upf/issues/958", "tags": ["Exploit", "Issue Tracking", "Patch"], "source": "cve@mitre.org"}, {"url": "https://github.com/omec-project/upf/issues/958", "tags": ["Exploit", "Issue Tracking", "Patch"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-476"}]}], "descriptions": [{"lang": "en", "value": "A denial-of-service vulnerability exists in the omec-project UPF (pfcpiface component) in version upf-epc-pfcpiface:2.1.3-dev. When the UPF receives a PFCP Session Report Response that is missing the mandatory Cause Information Element, the session report handler dereferences a nil pointer instead of rejecting the malformed message. This triggers a panic and terminates the UPF process. An attacker who can send PFCP Session Report Response messages to the UPF's N4/PFCP endpoint can exploit this flaw to repeatedly crash the UPF and disrupt user-plane services."}, {"lang": "es", "value": "Una vulnerabilidad de denegaci\u00f3n de servicio existe en el UPF del proyecto omec (componente pfcpiface) en la versi\u00f3n upf-epc-pfcpiface:2.1.3-dev. Cuando el UPF recibe una respuesta de informe de sesi\u00f3n PFCP a la que le falta el elemento de informaci\u00f3n de causa obligatorio, el gestor de informes de sesi\u00f3n desreferencia un puntero nulo en lugar de rechazar el mensaje malformado. Esto desencadena un p\u00e1nico y termina el proceso del UPF. Un atacante que puede enviar mensajes de respuesta de informe de sesi\u00f3n PFCP al punto final N4/PFCP del UPF puede explotar esta falla para bloquear repetidamente el UPF y perturbar los servicios del plano de usuario."}], "lastModified": "2026-10-13T11:10:00.203", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:linuxfoundation:upf:2.1.3:dev:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F5D98CF2-1D67-4E3A-B8AA-6B5F6D2FF666"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}