{"id":"CVE-2025-65562","details":"The free5GC UPF suffers from a lack of bounds checking on the SEID when processing PFCP Session Deletion Requests. An unauthenticated remote attacker can send a request with a very large SEID (e.g., 0xFFFFFFFFFFFFFFFF) that causes an integer conversion/underflow in LocalNode.DeleteSess() / LocalNode.Sess() when a uint64 SEID is converted to int and used in index arithmetic. This leads to a negative index into n.sess and a Go runtime panic, resulting in a denial of service (UPF crash). The issue has been reproduced on free5GC v4.1.0 with crashes observed in the session lookup/deletion path in internal/pfcp/node.go; other versions may also be affected. No authentication is required.","modified":"2026-09-04T03:30:53.772081602Z","published":"2025-12-18T00:00:00Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/65xxx/CVE-2025-65562.json","cna_assigner":"mitre"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/65xxx/CVE-2025-65562.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-65562"},{"type":"REPORT","url":"https://github.com/free5gc/free5gc/issues/731"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/free5gc/free5gc","events":[{"introduced":"de6bdb7a0d5963266c893cca59c86f55df348f57"},{"last_affected":"de6bdb7a0d5963266c893cca59c86f55df348f57"}],"database_specific":{"cpe":"cpe:2.3:a:free5gc:free5gc:4.1.0:*:*:*:*:*:*:*","extracted_events":[{"introduced":"4.1.0"},{"last_affected":"4.1.0"}],"source":"CPE_STRING"}}],"versions":["4.1.0","v4.1.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-65562.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}]}