CVE-2025-69232
Published: 23 February 2026
Summary
CVE-2025-69232 is a high-severity Improper Input Validation (CWE-20) vulnerability in Free5Gc Go-Upf. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 48.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Threat & Defense at a Glance
Threat & Defense Details
Likely Mitigating ControlsAI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Security testing and developer training directly verify and enforce proper input validation, reducing exploitability of injection and malformed-data weaknesses.
Security testing and evaluation at multiple SDLC stages directly detects missing or flawed input validation, with the required remediation process ensuring fixes are applied.
Directly implements checks on information inputs to reject invalid data before processing.
Spam protection mechanisms perform filtering and detection on inbound/outbound messages, directly compensating for missing or weak input validation of unsolicited content.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Malformed PFCP request enables remote unauthenticated exploitation of exposed UPF/SMF service (T1190) to trigger application-level DoS via inconsistent state (T1499.004).
NVD Description
free5GC is an open-source project for 5th generation (5G) mobile core networks. free5GC go-upf versions up to and including 1.2.6, corresponding to free5gc smf up to and including 1.4.0, have an Improper Input Validation and Protocol Compliance vulnerability leading to…
more
Denial of Service. Remote attackers can disrupt core network functionality by sending a malformed PFCP Association Setup Request. The UPF incorrectly accepts it, entering an inconsistent state that causes subsequent legitimate requests to trigger SMF reconnection loops and service degradation. All deployments of free5GC using the UPF and SMF components may be affected. As of time of publication, a fix is in development but not yet available. No direct workaround is available at the application level. Applying the official patch, once released, is recommended.
Deeper analysisAI
CVE-2025-69232 is an Improper Input Validation and Protocol Compliance vulnerability (CWE-20) affecting free5GC, an open-source implementation of 5G mobile core networks. The issue resides in the go-upf component versions up to and including 1.2.6, which corresponds to the smf component up to and including 1.4.0. It enables a Denial of Service condition with a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). All deployments utilizing the UPF and SMF components of free5GC are potentially vulnerable.
Remote attackers require no privileges or user interaction to exploit this vulnerability by sending a malformed PFCP Association Setup Request to the UPF. The UPF incorrectly accepts the request, entering an inconsistent state that disrupts core network functionality. Subsequent legitimate requests then trigger SMF reconnection loops, leading to service degradation and Denial of Service.
Advisories from the free5GC GitHub repository, including security advisory GHSA-8m42-qw58-8362 and issue #745, indicate that a fix is in development but not yet available as of publication on 2026-02-23. No direct application-level workaround exists, and applying the official patch upon release is recommended.
Details
- CWE(s)