CVE-2025-69247 Details
Description
free5GC go-upf is the User Plane Function (UPF) implementation for 5G networks that is part of the free5GC project. Versions prior to 1.2.8 have a Heap-based Buffer Overflow (CWE-122) vulnerability leading to Denial of Service. Remote attackers can crash the UPF network element by sending a specially crafted PFCP Session Modification Request with an invalid SDF Filter length field. This causes a heap buffer overflow, resulting in complete service disruption for all connected UEs and potential cascading failures affecting the SMF. All deployments of free5GC using the UPF component may be affected. Version 1.2.8 of go-upf contains a fix.
A heap-based buffer overflow vulnerability has been identified in the free5GC User Plane Function (UPF) component, specifically in versions prior to 1.2.8. This vulnerability allows remote attackers to disrupt UPF services by sending malformed PFCP Session Modification Requests that include invalid SDF Filter length fields. The exploitation of this vulnerability causes a heap buffer overflow, leading to a crash of the UPF network element. This crash disrupts services for all connected user equipment (UEs) and can cause cascading failures that affect the Session Management Function (SMF).
Users should upgrade to free5GC UPF version 1.2.8 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Feb 25, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/free5gc/free5gc/issues/746 | [email protected] | ExploitIssue TrackingPatchVendor Advisory |
| https://github.com/free5gc/free5gc/security/advisories/GHSA-gf69-93xr-p23g | [email protected] | PatchVendor Advisory |
| https://github.com/free5gc/go-upf/commit/b798fe5ee6a984be492fa53958dd5f1305469f85 | [email protected] | Patch |
| https://github.com/free5gc/go-upf/pull/85 | [email protected] | Issue TrackingPatch |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-122 | Heap-based Buffer Overflow | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| free5gc go-upf | < 1.2.8 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Feb 25, 2026 | Initial Analysis | [email protected] |
| Feb 23, 2026 | New CVE Received | [email protected] |