Quick answers
- Is CVE-2025-65568 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2025-65568 being exploited in the wild.
- How severe is CVE-2025-65568?
- High severity, with a CVSS score of 7.5, published 18 December 2025.
- Which products and versions are affected?
- OMEC Project UPF (pfcpiface) upf-epc-pfcpiface:2.1.3-dev.
- Is there a fix for CVE-2025-65568?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2025-65568 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2025-65568?
- Check whether you run OMEC Project UPF (pfcpiface) or Opennetworking Upf at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
A denial-of-service vulnerability exists in the pfcpiface component of omec-project UPF version 2.1.3-dev. The vulnerability is rooted in the `parseFAR()` function, which fails to validate the length of the IPv4 address field within a `CreateFAR` IE during a PFCP Session Establishment Request. When an empty or truncated address is provided, the subsequent call to `ip2int()` performs an out-of-bounds read on the buffer, triggering an index-out-of-range panic in Go. An unauthenticated network attacker capable of reaching the N4/PFCP endpoint can exploit this to crash the UPF service. A proof-of-concept exploit has been identified in public issue tracking.
Affected products
- omec-project UPF (pfcpiface) upf-epc-pfcpiface:2.1.3-dev
Timeline
- 2025-12-18: advisory: Initial disclosure of CVE-2025-65568
- 2025-12-19: other: CISA-ADP enrichment and SSVC analysis performed