CVE-2025-69232

free5GC is an open-source project for 5th generation (5G) mobile core networks. free5GC go-upf versions up to and including 1.2.6, corresponding to free5gc smf up to and including 1.4.0, have an Improper Input Validation and Protocol Compliance vulnerability leading to Denial of Service. Remote attackers can disrupt core network functionality by sending a malformed PFCP Association Setup Request. The UPF incorrectly accepts it, entering an inconsistent state that causes subsequent legitimate requests to trigger SMF reconnection loops and service degradation. All deployments of free5GC using the UPF and SMF components may be affected. As of time of publication, a fix is in development but not yet available. No direct workaround is available at the application level. Applying the official patch, once released, is recommended.

• CWE-20

• https://github.com/free5gc/free5gc/issues/745Exploit, Issue Tracking, Vendor Advisory
• https://github.com/free5gc/free5gc/security/advisories/GHSA-8m42-qw58-8362Vendor Advisory

Published

Feb 23, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-69227AIOHTTP is an asynchronous HTTP client/server framework for …7.5
• CVE-2025-69228AIOHTTP is an asynchronous HTTP client/server framework for …7.5
• CVE-2025-69229AIOHTTP is an asynchronous HTTP client/server framework for …5.3
• CVE-2025-6923Improper Neutralization of Input During Web Page Generation …5.4
• CVE-2025-69230AIOHTTP is an asynchronous HTTP client/server framework for …5.3
• CVE-2025-69231OpenEMR is a free and open source electronic health records …5.4
• CVE-2025-69233Due to multiple time-of-check time-of-use race conditions in…5.3
• CVE-2025-69234Whale browser before 4.35.351.12 allows an attacker to escap…9.1
• CVE-2025-69235Whale browser before 4.35.351.12 allows an attacker to bypas…7.5
• CVE-2025-69236Raytha CMS is vulnerable to Stored XSS via FieldValues[1].Va…5.4
• CVE-2025-69237Raytha CMS is vulnerable to Stored XSS via FieldValues[0].Va…5.4
• CVE-2025-69238Raytha CMS is vulnerable to Cross-Site Request Forgery acros…4.3