CVE-2025-69247

LOW EPSS 40.7%
Published Feb 23, 20264mo ago · Modified Feb 25, 20264mo ago
2.7 CVSS 4.0
Low
Find Similar
Published Feb 23, 2026 4mo ago
Last Modified Feb 25, 2026 4mo ago

Description

free5GC go-upf is the User Plane Function (UPF) implementation for 5G networks that is part of the free5GC project. Versions prior to 1.2.8 have a Heap-based Buffer Overflow (CWE-122) vulnerability leading to Denial of Service. Remote attackers can crash the UPF network element by sending a specially crafted PFCP Session Modification Request with an invalid SDF Filter length field. This causes a heap buffer overflow, resulting in complete service disruption for all connected UEs and potential cascading failures affecting the SMF. All deployments of free5GC using the UPF component may be affected. Version 1.2.8 of go-upf contains a fix.

CVSS Details

Base Score
2.7
Exploitability
—
Impact
—
Vector string
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction None
Scope X

Threat Intelligence

EPSS Exploit Probability
40.7% percentile
Exploit & Patch Status
Public Exploit Known
Patch Available

Weaknesses 1

CWE-122

Affected Products 1

VendorProductVersionRange
free5gcgo-upf* <1.2.8

References 4

  • github.com https://github.com/free5gc/free5gc/issues/746
    ExploitIssue TrackingPatchVendor Advisory
  • github.com https://github.com/free5gc/free5gc/security/advisories/GHSA-gf69-93xr-p23g
    PatchVendor Advisory
  • github.com https://github.com/free5gc/go-upf/commit/b798fe5ee6a984be492fa53958dd5f1305469f85
    Patch
  • github.com https://github.com/free5gc/go-upf/pull/85
    Issue TrackingPatch

Remediation

  • github.com https://github.com/free5gc/free5gc/issues/746
    ExploitIssue TrackingPatchVendor Advisory
  • github.com https://github.com/free5gc/free5gc/security/advisories/GHSA-gf69-93xr-p23g
    PatchVendor Advisory
  • github.com https://github.com/free5gc/go-upf/commit/b798fe5ee6a984be492fa53958dd5f1305469f85
    Patch
  • github.com https://github.com/free5gc/go-upf/pull/85
    Issue TrackingPatch