High · published December 19, 2025
⚡ A simple request with a wild SEID can send your free5GC UPF crashing down! An attacker can exploit this by sending an oversized identifier that trips the system. 🔥 Think of it like a waiter trying to deliver an order to a table that doesn't exist; when the table number is way too high, it causes chaos in the restaurant! An attacker can force the system into an infinite loop, leading to a denial of service as the UPF crashes. This means legitimate users can't access services, causing interruptions and potentially severe operational impacts.
Think of it like a waiter trying to deliver an order to a table that doesn't exist; when the table number is way too high, it causes chaos in the restaurant! This vulnerability arises from a lack of bounds checking on the Session Endpoint Identifier (SEID) during PFCP Session Deletion Requests, leading to an integer underflow in the LocalNode functions. This results in a runtime panic and ultimately crashes the UPF when processing requests.
An attacker can force the system into an infinite loop, leading to a denial of service as the UPF crashes. This means legitimate users can't access services, causing interruptions and potentially severe operational impacts. Upgrade your free5GC to version 4.1.1 or later where this vulnerability has been addressed. Additionally, implement input validation to ensure that SEID values are within acceptable bounds, preventing oversized inputs from causing issues. Regularly audit your systems to monitor for similar vulnerabilities. You've got this! Take these actions and strengthen your defenses! 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| free5gc/free5gc | all versions | — |