Executive brief
A denial-of-service vulnerability exists in the omec-project User Plane Function (UPF), a critical component in mobile core networks responsible for processing subscriber data traffic. By sending a specially crafted session request, an attacker can cause the system to crash repeatedly. This disruption prevents users from accessing mobile data services and impacts the overall availability of the cellular network infrastructure.
Technical details
A denial-of-service vulnerability exists in the pfcpiface component of omec-project UPF version 2.1.3-dev. The vulnerability is rooted in the `parseFAR()` function, which fails to validate the length of the IPv4 address field within a `CreateFAR` IE during a PFCP Session Establishment Request. When an empty or truncated address is provided, the subsequent call to `ip2int()` performs an out-of-bounds read on the buffer, triggering an index-out-of-range panic in Go. An unauthenticated network attacker capable of reaching the N4/PFCP endpoint can exploit this to crash the UPF service. A proof-of-concept exploit has been identified in public issue tracking.
Affected products
- omec-project UPF (pfcpiface) upf-epc-pfcpiface:2.1.3-dev
Timeline
- 2025-12-18: advisory: Initial disclosure of CVE-2025-65568
- 2025-12-19: other: CISA-ADP enrichment and SSVC analysis performed