High · published December 19, 2025
⚡ An attacker can crash the UPF process with a crafty PFCP message, turning your service into a digital tumbleweed! 🔥 Think of the UPF as a busy restaurant and the PFCP Session Establishment Request as an order ticket. If a waiter delivers a poorly written ticket that confuses the kitchen, it could lead to chaos, halting service entirely while everyone scrambles to fix it. If exploited, this denial-of-service vulnerability could cause repeated crashes of the UPF process, leading to significant service interruptions. Your entire network might be affected, leaving users unable to connect and causing a ripple effect of frustration across the board.
Think of the UPF as a busy restaurant and the PFCP Session Establishment Request as an order ticket. If a waiter delivers a poorly written ticket that confuses the kitchen, it could lead to chaos, halting service entirely while everyone scrambles to fix it. The issue lies in the pfcpiface component of the omec-project UPF, specifically in how it validates the Flow-Description in PFCP Session Establishment Requests. A malformed Flow-Description can cause the parser to read beyond its allocated memory, resulting in a panic and termination of the UPF process.
If exploited, this denial-of-service vulnerability could cause repeated crashes of the UPF process, leading to significant service interruptions. Your entire network might be affected, leaving users unable to connect and causing a ripple effect of frustration across the board. Immediately upgrade to a patched version of the UPF if available. Review and implement robust input validation for PFCP Session Establishment Requests to prevent malformed packets from crashing the service. Keep an eye on updates from the omec-project to stay ahead of potential vulnerabilities. You've got this! With a few fixes, you'll have your UPF running smoothly in no time! 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| opennetworking/upf | all versions | — |