High · published December 19, 2025
⚡ A single malformed request can send your user-plane services crashing down! This denial-of-service vulnerability in omec-upf is like a mischievous prankster smashing the reset button on your gaming console. 🎮 Think of the UPF as a restaurant's kitchen. If a waiter brings an order without a vital ingredient — like the Recovery Time Stamp — the chef panics and shuts down the kitchen rather than asking for clarification. That's what this bug does to the UPF process, leaving everyone outside hungry for data! An attacker who knows how to send this sneaky PFCP Association Setup Request can repeatedly crash the UPF, disrupting user-plane services and leaving users without access. Imagine an on-demand service that suddenly stops responding, causing frustration and downtime for everyone relying on it!
Think of the UPF as a restaurant's kitchen. If a waiter brings an order without a vital ingredient — like the Recovery Time Stamp — the chef panics and shuts down the kitchen rather than asking for clarification. That's what this bug does to the UPF process, leaving everyone outside hungry for data! This vulnerability occurs when the UPF does not validate incoming PFCP messages properly, leading to a nil pointer dereference and causing the UPF process to panic and terminate. Essentially, it's a failure to check the essentials before proceeding, which results in a total service shutdown.
An attacker who knows how to send this sneaky PFCP Association Setup Request can repeatedly crash the UPF, disrupting user-plane services and leaving users without access. Imagine an on-demand service that suddenly stops responding, causing frustration and downtime for everyone relying on it! To combat this vulnerability, immediately update to a patched version of omec-upf that addresses this issue. Additionally, implement input validation to ensure all necessary elements are present in incoming requests. Maintaining robust monitoring can help detect any unusual request patterns as well! You've got this! By following these steps, you'll not only fix the immediate issue but also bolster your defenses for the future. 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| opennetworking/upf | all versions | — |