Vulnerability · Published Feb 23, 2026 · Assigned by GitHub_M

CVE-2025-69247free5GC has Heap Buffer Overflow in UPF Leading to Denial of Service

Low 2.7

In plain English

A low-severity heap buffer overflow in go-upf from free5gc. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 50% of all known vulnerabilities).

Severity (CVSS 4.0)2.7Low

Exploit odds (30 days)0.6%top 50.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

free5GC go-upf is the User Plane Function (UPF) implementation for 5G networks that is part of the free5GC project. Versions prior to 1.2.8 have a Heap-based Buffer Overflow (CWE-122) vulnerability leading to Denial of Service. Remote attackers can crash the UPF network element by sending a specially crafted PFCP Session Modification Request with an invalid SDF Filter length field. This causes a heap buffer overflow, resulting in complete service disruption for all connected UEs and potential cascading failures affecting the SMF. All deployments of free5GC using the UPF component may be affected. Version 1.2.8 of go-upf contains a fix.

Affected products (as reported)

Vendor	Product	Versions
free5gc	go-upf	< 1.2.8

Weakness: CWE-122 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U

References

https://github.com/free5gc/free5gc/security/advisories/GHSA-gf69-93xr-p23g x_refsource_CONFIRM
https://github.com/free5gc/free5gc/issues/746 x_refsource_MISC
https://github.com/free5gc/go-upf/pull/85 x_refsource_MISC
https://github.com/free5gc/go-upf/commit/b798fe5ee6a984be492fa53958dd5f1305469f85 x_refsource_MISC