CVE-2026-2525
📋 TL;DR
A denial-of-service vulnerability exists in Free5GC's PFCP UDP Endpoint component, allowing remote attackers to crash the service by sending specially crafted packets. This affects all Free5GC deployments up to version 4.1.0 that use the vulnerable PFCP functionality.
💻 Affected Systems
- Free5GC
📦 What is this software?
Free5gc by Free5gc
⚠️ Risk & Real-World Impact
Worst Case
Complete service disruption of Free5GC core network functions, potentially affecting mobile network connectivity for all users served by the vulnerable instance.
Likely Case
Service crashes requiring manual restart, causing temporary service outages and potential data loss for in-flight sessions.
If Mitigated
Minimal impact with proper network segmentation and monitoring allowing quick detection and recovery.
🎯 Exploit Status
Exploit details have been publicly disclosed in GitHub issues. The vulnerability requires sending malformed PFCP packets to the UDP endpoint.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Version 4.1.1 or later
Vendor Advisory: https://github.com/free5gc/free5gc/issues/796
Restart Required: Yes
Instructions:
1. Update Free5GC to version 4.1.1 or later. 2. Restart all Free5GC services. 3. Verify the PFCP UDP Endpoint is functioning correctly.
🔧 Temporary Workarounds
Network Access Control
linuxRestrict access to PFCP UDP port (8805 by default) to trusted sources only using firewall rules.
iptables -A INPUT -p udp --dport 8805 -s trusted_ip_range -j ACCEPT
iptables -A INPUT -p udp --dport 8805 -j DROP
Rate Limiting
linuxImplement rate limiting on PFCP UDP traffic to reduce impact of DoS attempts.
iptables -A INPUT -p udp --dport 8805 -m limit --limit 100/sec --limit-burst 200 -j ACCEPT
iptables -A INPUT -p udp --dport 8805 -j DROP
🧯 If You Can't Patch
- Implement strict network segmentation to isolate Free5GC instances from untrusted networks
- Deploy intrusion detection systems to monitor for malformed PFCP packets and alert on potential exploitation attempts
🔍 How to Verify
Check if Vulnerable:
Check Free5GC version: if version is 4.1.0 or earlier, the system is vulnerable. Verify PFCP UDP endpoint is listening on port 8805.Check Version:
free5gc versionVerify Fix Applied:
After patching, verify version is 4.1.1 or later and test PFCP functionality with legitimate traffic.📡 Detection & Monitoring
Log Indicators:
- Unexpected PFCP endpoint crashes
- Error messages related to malformed PFCP packets
- Service restart logs without normal shutdown
Network Indicators:
- Unusual volume of UDP traffic on port 8805
- Malformed PFCP packets in network captures
- Source IPs sending abnormal PFCP message sequences
SIEM Query:
source="free5gc" AND ("crash" OR "panic" OR "segmentation fault") AND "PFCP"