PFCP, the Packet Forwarding Control Protocol, is a 5G control-plane protocol used by the Session Management Function (SMF) to instruct the User Plane Function (UPF) how to forward traffic. It can create, update, and delete forwarding rules, so it sits directly between session control and packet handling.
PFCP matters because a mistake in its parsing or trust model can affect real traffic, not just a control message. If a network endpoint accepts forged, malformed, or out-of-context PFCP requests, an attacker may trigger denial of service, state confusion, or traffic diversion. In practice, defenders harden PFCP by tightly segmenting core signaling interfaces, validating session state and rule consistency, rate-limiting unusual modification bursts, and monitoring for unexpected association or forwarding-rule changes. In cloud-native 5G cores, PFCP exposure is especially sensitive because the usual physical network boundaries are weaker than in legacy deployments.