CVE-2025-70123: Input Validation

Published Feb 13, 2026

Updated

An improper input validation and protocol compliance vulnerability in free5GC v4.0.1 allows remote attackers to cause a denial of service. The UPF incorrectly accepts a malformed PFCP Association Setup Request, violating 3GPP TS 29.244. This places the UPF in an inconsistent state where a subsequent valid PFCP Session Establishment Request triggers a cascading failure, disrupting the SMF connection and causing service degradation.

Affected Software

2 affected components

free5gc Free5gc=4.0.1

Event History

Feb 13, 2026

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

Data Sourced

via NVD·05:16 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2025-70123?

CVE-2025-70123 is classified as a denial of service vulnerability.

How do I fix CVE-2025-70123?

To mitigate CVE-2025-70123, upgrade the free5GC software to a version that addresses this vulnerability.

Who is affected by CVE-2025-70123?

CVE-2025-70123 affects users of free5GC version 4.0.1.

What type of attack does CVE-2025-70123 facilitate?

CVE-2025-70123 allows remote attackers to cause a denial of service.

What systems are vulnerable to CVE-2025-70123?

The vulnerability CVE-2025-70123 specifically impacts the UPF component of free5GC version 4.0.1.