漏洞关键信息 漏洞类型: - SMF crash (nil pointer dereference) 受影响的组件: - Package: (Go) - Affected versions: <= v4.1.0 严重程度: - High CVE ID: - CVE-2026-26025 CWE ID: - CWE-476 影响: - Remote Denial of Service (DoS) — SMF panics and terminates when processing a malformed PFCP SessionReportRequest on the PFCP (UDP/8805) interface. 相关事件: - GHSA-vw8r-p7h3-g3xh 补丁: - No upstream fix/PR is referenced in the issue ("No branches or pull requests"). Recommended patch: add validation / nil-check for report.URRID (and related required sub-IEs) before dereferencing, and reject malformed reports gracefully. - Patched versions: None 临时变通方法: - ACL / firewall PFCP interface so only trusted UPF IPs can reach SMF (reduce spoofing/abuse surface). - Drop/inspect malformed PFCP SessionReportRequest messages at the network edge where feasible. - Add recover() around PFCP handler dispatch to avoid whole-process termination (mitigation only). 报告人: - LinZiyuu