CVE-2025-15156CWE-404CWE-476

CVE-2025-15156

Medium · published December 29, 2025

CVSS v3.1
4.3
EPSS
0%
Percentile
24.0
In the wild
Unconfirmed
What it is

A flaw has been found in omec-project UPF up to 2.1.3-dev. This affects the function handleSessionEstablishmentRequest of the file /pfcpiface/pfcpiface/messages_session.go of the component PFCP Session Establishment Request Handler. This manipulation causes null pointer dereference. The attack may be initiated remotely. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
CVSS v4.0
Not supplied
EPSS
0.00322 · 24.0th percentile
Weaknesses
CWE-404 · Improper Resource Shutdown or Release; CWE-476 · NULL Pointer Dereference
Published
2025-12-29T03:15Z
References (4)
https://github.com/omec-project/upf/issues/979 · [email protected]https://vuldb.com/?ctiid.338534 · [email protected]https://vuldb.com/?id.338534 · [email protected]https://vuldb.com/?submit.719824 · [email protected]
EPSS history
Timeline
  • 28 DEC 22:02Z
    omec-project UPF PFCP Session Establishment Request messages_session.go handleSessionEstablishmentRequest null pointer dereference
    cvelistv5