A flaw in the Free5GC v4.2.3 SMF component causes allocated UE IP addresses to remain reserved when a PFCP Session Establishment Response is not received. The SMF incorrectly retains these resources, allowing an attacker to repeatedly trigger failed session establishment attempts and consume the entire IP address pool. When the pool is exhausted, new User Equipments cannot create PDU sessions, effectively denying the service to legitimate users.

The vulnerability affects the SMF component of the Free5GC network function virtualization stack, specifically version 4.2.3. No vendor identifier is available, but any deployment of Free5GC v4.2.3 that performs PFCP session establishment will be impacted.

The vulnerability is a clear resource exhaustion (Denial of Service) flaw that can be exercised from outside the SMF by repeatedly sending PFCP Session Establishment requests that fail to elicit a response. Because the exploit requires only repeated interactions with the SMF, it is feasible over the control network. Although no EPSS score is available and the issue is not listed in CISA KEV, the absence of a mitigation means the risk of a successful denial of service persists until the defect is fixed.