CVE-2025-65568 Denial of service in n/a
An attacker can crash the UPF by sending malformed PFCP requests, disrupting user-plane services in 5G core networks.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-65568?
CVE-2025-65568 is a high-severity denial of service vulnerability in n/a, published on 18 Dec 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A denial-of-service vulnerability exists in the omec-project UPF (pfcpiface component) in version upf-epc-pfcpiface:2.1.3-dev. After PFCP association, a PFCP Session Establishment Request that includes a CreateFAR with an empty or truncated IPv4 address field is not properly validated. During parsing, parseFAR() calls ip2int(), which performs an out-of-bounds read on the IPv4 address buffer and triggers an index-out-of-range panic. An attacker who can send PFCP Session Establishment Request messages to the UPF's N4/PFCP endpoint can exploit this issue to repeatedly crash the UPF and disrupt user-plane services.
Weakness: CWE-125
Which versions are affected by CVE-2025-65568?
It affects 1 product.
Products include Opennetworking Upf.
How do I fix CVE-2025-65568?
No fix has been published for CVE-2025-65568 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2025-65568 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-65568 exists.
Other vulnerabilities in n/a
Sources
Also known as GHSA-hg6h-53hm-4646.