CVE-2025-65562: The free5GC UPF suffers from a lack of bounds checking on the SEID when processing PFCP Session Deletion Requests. An…
CVE-2025-65562 · Severity: high · CVSS 7.5 · Published 2025-12-18
The free5GC UPF suffers from a lack of bounds checking on the SEID when processing PFCP Session Deletion Requests. An unauthenticated remote attacker can send a request with a very large SEID (e.g., 0xFFFFFFFFFFFFFFFF) that causes an integer conversion/underflow in LocalNode.DeleteSess() / LocalNode.Sess() when a uint64 SEID is converted to int and used in index arithmetic. This leads to a negative index into n.sess and a Go runtime panic, resulting in a denial of service (UPF crash). The issue has been reproduced on free5GC v4.1.0 with crashes observed in the session lookup/deletion path in internal/pfcp/node.go; other versions may also be affected. No authentication is required.
No. Junglewise Threat Intelligence has no report of CVE-2025-65562 being exploited in the wild.
How severe is CVE-2025-65562?
High severity, with a CVSS score of 7.5, published 18 December 2025.
Which products and versions are affected?
free5GC. The advisory does not name versions.
Is there a fix for CVE-2025-65562?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
Am I affected by CVE-2025-65562?
Check whether you run free5GC. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.