High · published December 19, 2025
⚡ A missing piece in a critical request triggers a full-blown crash! An attacker can send a PFCP Session Establishment Request without the essential F-SEID element, causing the UPF to implode. 🔥 Think of it like an airport security checkpoint—if someone skips showing their ID, the whole line comes to a screeching halt while security scrambles to fix the situation! This vulnerability disrupts the user-plane services just like that chaos at the airport. ✈️ If exploited, this denial-of-service vulnerability can repeatedly crash the UPF, bringing user-plane services to a standstill. Imagine the havoc—users might experience dropped connections and disrupted services, leading to absolute frustration across the board!
Think of it like an airport security checkpoint—if someone skips showing their ID, the whole line comes to a screeching halt while security scrambles to fix the situation! This vulnerability disrupts the user-plane services just like that chaos at the airport. ✈️ The vulnerability stems from improper validation of the PFCP Session Establishment Request in the omec-project UPF's pfcpiface component. When the handler calls for the mandatory F-SEID information but finds it missing, it tries to process a nil pointer, resulting in a process panic.
If exploited, this denial-of-service vulnerability can repeatedly crash the UPF, bringing user-plane services to a standstill. Imagine the havoc—users might experience dropped connections and disrupted services, leading to absolute frustration across the board! To mitigate this, upgrade to a patched version of the omec-project UPF beyond 2.1.3-dev. Additionally, implement input validation to ensure all mandatory fields are checked before processing any session requests. 🛡️ You've got this! By taking these steps, you’ll strengthen your defenses and keep everything running smoothly. 💪✨
| Product | Versions | Fixed in |
|---|---|---|
| opennetworking/upf | all versions | — |