CVE-2026-25659: Ericsson Packet Core Gateway DOS Flaw

CVE-2026-25659 Overview

CVE-2026-25659 affects Ericsson Packet Core Gateway (PCG) versions prior to 1.30. The vulnerability is classified as Improper Handling of Missing Values [CWE-230]. An adjacent-network attacker who continuously sends a specially crafted message can cause service degradation on the PCG. The service degradation persists for the duration of the attack, but the system recovers from the crashes once the attack stops. The flaw impacts availability of mobile core network traffic processing handled by the PCG, a critical component in 5G and converged packet core deployments.

Critical Impact
Sustained transmission of a crafted message from an adjacent network position can degrade Ericsson PCG service availability, disrupting subscriber traffic for the duration of the attack.

Affected Products

Ericsson Packet Core Gateway (PCG) versions prior to 1.30

Discovery Timeline

2026-06-05 - CVE-2026-25659 published to NVD
2026-06-08 - Last updated in NVD database

Technical Details for CVE-2026-25659

Vulnerability Analysis

The Ericsson Packet Core Gateway processes signaling and user-plane traffic for mobile core networks. CVE-2026-25659 results from improper handling of missing values [CWE-230] within message processing logic. When the PCG receives a specially crafted message containing absent or unexpected field values, the affected component fails to validate the missing data correctly. This triggers a crash in the processing service. Repeated delivery of the crafted message causes repeated crashes, producing observable service degradation for subscribers and network functions that depend on the gateway.

The vulnerability is a denial-of-service condition rather than a memory corruption or code execution issue. Confidentiality and integrity are not impacted. Only availability is affected. Recovery is automatic once the attacker stops sending the malicious traffic, indicating the PCG includes process or pod-level restart logic but lacks input validation that would prevent the crash in the first place.

Root Cause

The root cause is missing input validation for absent fields in a specific message type processed by the PCG. The CWE-230 classification indicates the application assumes required fields are present without verifying their existence before dereferencing or processing them.

Attack Vector

Exploitation requires adjacent network access, meaning the attacker must reach the PCG over a logically adjacent network segment such as a signaling or transport network used by the packet core. Authentication is not required. No user interaction is needed. The attacker must sustain the malicious traffic to maintain the degraded state. Refer to the Ericsson Security Advisory CVE-2026-25659 for vendor-specific technical details.

No public proof-of-concept or exploit code is currently available for this vulnerability.

Detection Methods for CVE-2026-25659

Indicators of Compromise

Repeated process or pod restarts on Ericsson PCG nodes without corresponding maintenance activity
Spikes in malformed or incomplete signaling messages on interfaces terminating at the PCG
Subscriber session drops, increased session setup failures, or elevated latency aligned with PCG component crashes
Crash logs or core dumps generated by PCG services referencing message parsing routines

Detection Strategies

Correlate PCG service restart events with inbound traffic patterns to identify malformed message floods
Inspect signaling traffic at the transport boundary for messages with missing mandatory fields
Baseline normal PCG availability metrics and alert on deviations in pod restart counts or service uptime

Monitoring Recommendations

Forward PCG application, container, and orchestrator logs into a centralized analytics platform for correlation
Monitor 5G core key performance indicators including session establishment success rate and PCG node health
Enable alerting on repeated crash signatures within the PCG message processing components
Track adjacent-network traffic sources that generate disproportionate volumes of malformed signaling messages

How to Mitigate CVE-2026-25659

Immediate Actions Required

Upgrade Ericsson Packet Core Gateway to version 1.30 or later as specified in the vendor advisory
Restrict access to PCG signaling and management interfaces to authorized adjacent network elements only
Review network segmentation to ensure untrusted networks cannot reach PCG interfaces
Coordinate with Ericsson support to confirm the appropriate upgrade path for the deployed PCG release train

Patch Information

Ericsson has released a fixed version of Packet Core Gateway. Operators should upgrade to PCG version 1.30 or later. Full remediation details are documented in the Ericsson Security Advisory CVE-2026-25659.

Workarounds

Apply strict access control lists on transport networks to limit which peers can send signaling traffic to the PCG
Deploy rate limiting or anomaly detection at the network boundary to drop sustained floods of malformed messages
Enable redundant PCG instances and validate failover behavior to reduce the impact of crash-induced restarts
Monitor for and block source addresses associated with repeated malformed message delivery until patching is complete

bash

# Configuration example
# Verify the running PCG version and plan upgrade to >= 1.30
# Replace placeholders with environment-specific values
kubectl -n packet-core get pods -l app=pcg -o jsonpath='{.items[*].spec.containers[*].image}'

# Example transport-layer ACL to restrict signaling peers (illustrative)
# permit signaling only from trusted peer subnets
# access-list pcg-signaling permit <protocol> <trusted-peer-subnet> host <pcg-vip>
# access-list pcg-signaling deny   any host <pcg-vip>