CVE-2025-60632 Free5GC is vulnerable to DoS through its Npcf_BDTPolicyControl POST API

What is CVE-2025-60632?

CVE-2025-60632 is a medium-severity denial of service vulnerability in Free5gc Free5gc, published on 24 Nov 2025. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

An issue was discovered in Free5GC v4.0.0 and v4.0.1 allowing an attacker to cause a denial of service via crafted POST request to the Npcf_BDTPolicyControl API.

Weakness: CWE-617

Which versions are affected by CVE-2025-60632?

3 open source packages ship an affected version, including github.com/free5gc/pcf. It affects 1 product.

Products include Free5gc Free5gc.

How do I fix CVE-2025-60632?

Upgrade github.com/free5gc/pcf to 1.4.0 or later.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2025-60632 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-60632 exists.

Other vulnerabilities in Free5gc Free5gc

• CVE-2026-44327 free5GC: NEF nnef-oam route group is unauthenticated; no-token requests reach the OAM handler Critical 10.0
• CVE-2026-44329 free5GC's SMF UPI management interface lacks auth middleware; unauthenticated topology read/write requests reach handlers Critical 10.0
• CVE-2026-44330 free5GC's NEF nnef-pfdmanagement API is unauthenticated; forged bearer tokens can read PFD data and create/delete PFD subscriptions Critical 10.0
• CVE-2025-63679 Memory corruption in n/a Critical 9.8
• CVE-2026-44315 free5GC's NEF 3gpp-pfd-management API is unauthenticated; forged bearer tokens can create, read, and delete PFD transactions Critical 9.4

All Free5gc Free5gc vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-vgq7-9r5r-j9v3, GO-2025-4164.