CVE-2026-75439: Free5GC UPF Component DOS Vulnerability

CVE-2026-75439 Overview

CVE-2026-75439 is a denial of service vulnerability affecting Free5GC v4.2.2, an open-source 5G core network implementation. The flaw resides in the User Plane Function (UPF) component, which handles user data packet forwarding and processing in 5G networks. A remote attacker can trigger a denial of service condition against the UPF, disrupting user plane traffic handling across the affected 5G core deployment.

Critical Impact
Remote attackers can disrupt 5G core network user plane operations by targeting the UPF component, degrading or halting data plane services for connected subscribers.

Affected Products

Free5GC v4.2.2
go-upf component (Free5GC User Plane Function)
5G core network deployments running the affected UPF release

Discovery Timeline

2026-09-04 - CVE-2026-75439 published to NVD
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-75439

Vulnerability Analysis

The vulnerability affects the UPF component in Free5GC v4.2.2. The UPF is responsible for packet routing, forwarding, and Quality of Service (QoS) enforcement in the 5G core user plane. A remote attacker can send crafted input to the UPF that causes the component to enter a denial of service state.

Because the UPF sits on the data path for all subscriber traffic, disruption of this component halts user plane packet processing. Impact scales with deployment size, since a single UPF failure can affect all sessions anchored on that instance. The issue has been discussed publicly in the Free5GC project and a fix is tracked in the go-upf pull request #97.

Root Cause

Details from the upstream discussion in Free5GC issue #1059 indicate the UPF fails to handle a specific input condition safely. Improper validation of received packet fields allows the attacker input to reach code paths that terminate or hang the UPF process. The upstream patch in the go-upf repository adjusts input handling to prevent the failure mode.

Attack Vector

An attacker with network reachability to the UPF's user plane interface can transmit crafted packets to trigger the fault. No authentication is required beyond the ability to deliver traffic to the UPF's exposed data plane interfaces. Proof of concept material is published in the CVE-2026-75439 repository and a GitHub Gist PoC.

See the referenced upstream materials for technical details of the crafted input required to reproduce the condition. No synthetic exploit code is included here.

Detection Methods for CVE-2026-75439

Indicators of Compromise

Unexpected termination or restart of the UPF process on Free5GC nodes running v4.2.2
Sudden loss of user plane connectivity for subscribers anchored to a specific UPF instance
Anomalous packet patterns directed at UPF data plane interfaces immediately preceding a service outage
Error entries in UPF logs referencing malformed or unexpected packet fields

Detection Strategies

Monitor Free5GC UPF process health and correlate crashes with inbound traffic captures on N3, N4, and N6 interfaces
Deploy network telemetry to identify traffic sources sending anomalous or malformed GTP-U traffic to UPF endpoints
Alert on repeated UPF service restarts within short time windows as an early indicator of exploitation attempts

Monitoring Recommendations

Enable verbose UPF logging and forward logs to a centralized analytics platform for pattern analysis
Capture packet metadata on user plane interfaces to enable retroactive analysis of failure events
Track subscriber session drop rates and correlate anomalies with UPF component availability metrics

How to Mitigate CVE-2026-75439

Immediate Actions Required

Inventory all Free5GC deployments and identify instances running v4.2.2
Restrict network reachability to UPF data plane interfaces so only trusted RAN and peering endpoints can send traffic
Apply the upstream fix tracked in go-upf pull request #97 once merged and released
Prepare UPF process supervision and automatic restart to reduce outage duration if exploitation occurs

Patch Information

The upstream remediation is being tracked in the go-upf repository via pull request #97, which is referenced from Free5GC issue #1059. Operators running Free5GC v4.2.2 should track the pull request and upgrade UPF binaries once the fix is merged and a release is published.

Workarounds

Segment the UPF onto isolated network paths reachable only from authorized gNodeB and peering endpoints
Deploy stateful filtering in front of the UPF to drop malformed GTP-U packets before they reach the vulnerable component
Where feasible, distribute subscriber sessions across multiple UPF instances to limit blast radius of a single component failure

bash

# Example: restrict UPF N3 interface access to authorized RAN subnets only
iptables -A INPUT -i n3 -s <trusted_ran_subnet> -p udp --dport 2152 -j ACCEPT
iptables -A INPUT -i n3 -p udp --dport 2152 -j DROP