CVE-2025-69232
Published: 23 February 2026
Summary
CVE-2025-69232 is a low-severity Improper Input Validation (CWE-20) vulnerability in Free5Gc Go-Upf. Its CVSS base score is 2.7 (Low).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 48.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SC-5 (Denial-of-service Protection) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2025-69232 is an Improper Input Validation and Protocol Compliance vulnerability (CWE-20) affecting free5GC, an open-source implementation of 5G mobile core networks. The issue resides in the go-upf component versions up to and including 1.2.6, which corresponds to the smf component up to and including 1.4.0. It enables a Denial of Service condition with a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). All deployments utilizing the UPF and SMF components of free5GC are potentially vulnerable.
Remote attackers require no privileges or user interaction to exploit this vulnerability by sending a malformed PFCP Association Setup Request to the UPF. The UPF incorrectly accepts the request, entering an inconsistent state that disrupts core network functionality. Subsequent legitimate requests then trigger SMF reconnection loops, leading to service degradation and Denial of Service.
Advisories from the free5GC GitHub repository, including security advisory GHSA-8m42-qw58-8362 and issue #745, indicate that a fix is in development but not yet available as of publication on 2026-02-23. No direct application-level workaround exists, and applying the official patch upon release is recommended.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-207569
Vulnerability details
free5GC is an open-source project for 5th generation (5G) mobile core networks. free5GC go-upf versions up to and including 1.2.6, corresponding to free5gc smf up to and including 1.4.0, have an Improper Input Validation and Protocol Compliance vulnerability leading to…
more
Denial of Service. Remote attackers can disrupt core network functionality by sending a malformed PFCP Association Setup Request. The UPF incorrectly accepts it, entering an inconsistent state that causes subsequent legitimate requests to trigger SMF reconnection loops and service degradation. All deployments of free5GC using the UPF and SMF components may be affected. As of time of publication, a fix is in development but not yet available. No direct workaround is available at the application level. Applying the official patch, once released, is recommended.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Malformed PFCP request enables remote unauthenticated exploitation of exposed UPF/SMF service (T1190) to trigger application-level DoS via inconsistent state (T1499.004).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
SI-10 directly mandates validation of information inputs like malformed PFCP Association Setup Requests to prevent the UPF from entering an inconsistent state.
SC-5 provides denial-of-service protections that limit the impact of malformed PFCP requests causing SMF reconnection loops and service degradation.
SI-11 ensures secure error handling for input validation failures, mitigating the risk of inconsistent states triggered by malformed PFCP messages.