CVE-2025-65568: n/a
A denial-of-service vulnerability exists in the omec-project UPF (pfcpiface component) in version upf-epc-pfcpiface:2.1.3-dev. After PFCP association, a PFCP Session Establishment Request that includes a CreateFAR with an empty or truncated IPv4 address field is not properly validated. During parsing, parseFAR() calls ip2int(), which performs an out-of-bounds read on the IPv4 address buffer and triggers an index-out-of-range panic. An attacker who can send PFCP Session Establishment Request messages to the UPF's N4/PFCP endpoint can exploit this issue to repeatedly crash the UPF and disrupt user-plane services.
AI Analysis
Technical Summary
The vulnerability in omec-project UPF (pfcpiface component) version 2.1.3-dev occurs after PFCP association when a PFCP Session Establishment Request includes a CreateFAR with an empty or truncated IPv4 address field. The parseFAR() function calls ip2int(), which performs an out-of-bounds read on the IPv4 address buffer, triggering an index-out-of-range panic. An attacker capable of sending PFCP Session Establishment Request messages to the UPF's N4/PFCP endpoint can exploit this to repeatedly crash the UPF, causing denial-of-service and disruption of user-plane services.
Potential Impact
Exploitation of this vulnerability results in a denial-of-service condition by crashing the UPF component, thereby disrupting user-plane services. There is no impact on confidentiality or integrity, but availability is severely affected.
Mitigation Recommendations
No patch or official fix is currently available for this vulnerability. Users should monitor vendor advisories for updates. Until a fix is released, restricting access to the UPF's N4/PFCP endpoint to trusted sources may reduce exposure. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.
CVE-2025-65568: n/a
Description
A denial-of-service vulnerability exists in the omec-project UPF (pfcpiface component) in version upf-epc-pfcpiface:2.1.3-dev. After PFCP association, a PFCP Session Establishment Request that includes a CreateFAR with an empty or truncated IPv4 address field is not properly validated. During parsing, parseFAR() calls ip2int(), which performs an out-of-bounds read on the IPv4 address buffer and triggers an index-out-of-range panic. An attacker who can send PFCP Session Establishment Request messages to the UPF's N4/PFCP endpoint can exploit this issue to repeatedly crash the UPF and disrupt user-plane services.
CVSS v3.1
Score 7.5high
Affected software
pkg:github/omec-project/upfRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability in omec-project UPF (pfcpiface component) version 2.1.3-dev occurs after PFCP association when a PFCP Session Establishment Request includes a CreateFAR with an empty or truncated IPv4 address field. The parseFAR() function calls ip2int(), which performs an out-of-bounds read on the IPv4 address buffer, triggering an index-out-of-range panic. An attacker capable of sending PFCP Session Establishment Request messages to the UPF's N4/PFCP endpoint can exploit this to repeatedly crash the UPF, causing denial-of-service and disruption of user-plane services.
Potential Impact
Exploitation of this vulnerability results in a denial-of-service condition by crashing the UPF component, thereby disrupting user-plane services. There is no impact on confidentiality or integrity, but availability is severely affected.
Mitigation Recommendations
No patch or official fix is currently available for this vulnerability. Users should monitor vendor advisories for updates. Until a fix is released, restricting access to the UPF's N4/PFCP endpoint to trusted sources may reduce exposure. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- mitre
- Date Reserved
- 2025-11-18T00:00:00.000Z
- State
- PUBLISHED
Threat ID: 694451e44eb3efac36a23a4e
Added to database: 12/18/2025, 19:11:32 UTC
Last enriched: 07/05/2026, 21:06:21 UTC
Last updated: 09/10/2026, 19:36:51 UTC
Views: 174
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.