CVE-2025-15156

Name of the Vulnerable Software and Affected Versions omec-project UPF versions up to 2.1.3-dev

Description A flaw exists in omec-project UPF that may allow for remote exploitation. The issue resides in the handleSessionEstablishmentRequest function within the /pfcpiface/pfcpiface/messages session.go file of the PFCP Session Establishment Request Handler component. This manipulation can lead to a null pointer dereference. Reports indicate increased targeting of this vulnerability by malicious actors. The exploit has been published.

Recommendations Versions prior to 2.1.3-dev should be updated. As a temporary workaround, consider disabling the handleSessionEstablishmentRequest function until a patch is available.