Read the docs
TI-2026-25506 Aliases CVE-2026-33064GHSA-7g27-v5wj-jr75

free5GC UDM DataChangeNotification Procedure Panic Due to Nil Pointer Dereference

Priority HIGH 77CWE-478Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-476.

Summary

Free5GC is an open-source Linux Foundation project for 5th generation (5G) mobile core networks. Versions prior to 1.4.2 are vulnerable to procedure panic caused by Nil Pointer Dereference in the /sdm-subscriptions endpoint. A remote attacker can cause the UDM service to panic and crash by sending a crafted POST request to the /sdm-subscriptions endpoint with a malformed URL path containing path traversal sequences (../) and a large JSON payload. The DataChangeNotificationProcedure function in notifier.go attempts to access a nil pointer without proper validation, causing a complete service crash with "runtime error: invalid memory address or nil pointer dereference". Exploitation would result in UDM functionality disruption until recovery by restart. This issue has been fixed in version 1.4.2.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00506 43rd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed free5gc (free5gc): 1.4.2github.com/free5gc/udm (Go): 1.4.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
free5gcfree5gcbefore 1.4.21.4.2Patch availableCNA
—github.com/free5gc/udm (Go)before 1.4.21.4.2Patch availableGHSA-7g27-v5wj-jr75
  • free5gc Vendorfree5gc Affected before 1.4.2 Fixed in 1.4.2 Patch available CNA
  • github.com/free5gc/udm (Go) Vendor— Affected before 1.4.2 Fixed in 1.4.2 Patch available GHSA-7g27-v5wj-jr75

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:free5gc:udm:*:*:*:*:*:go:*:*before 1.4.2Vulnerablefree5gc
  • cpe:2.3:a:free5gc:udm:*:*:*:*:*:go:*:* Versions before 1.4.2 Vulnerable ·free5gc

Remediation

  • Fix · CNA free5gc (free5gc) Fixed in 1.4.2
  • Fix · GHSA-7g27-v5wj-jr75 github.com/free5gc/udm (Go) Fixed in 1.4.2 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-33064
  2. 2026-10-03 Alias added: GHSA-7g27-v5wj-jr75
  3. 2026-10-25 EPSS moved to the below the 50th percentile

References

Exploit 1

Patch 3

Advisory 1

Other 1

  • TI-2026-25617 free5GC UDM incorrectly returns 500 for empty supi path parameter in PATCH sdm-subscriptions reques CVSS 4.0HIGH 8.7
  • TI-2026-25507 free5GC UDM incorrectly returns 500 for empty supi path parameter in DELETE sdm-subscriptions request CVSS 4.0MEDIUM 6.9
  • TI-2026-25616 free5GC UDM vulnerable to null byte injection in URL path parameters causing 500 Internal Server Error CVSS 4.0HIGH 8.7
  • TI-2026-22024 free5GC has Improper Input Validation in UDM UEAU Service CVSS 4.0MEDIUM 6.6
  • TI-2025-42704 free5GC has Null Pointer Dereference in UDM, Leading to Service Panic CVSS 4.0MEDIUM 6.6
  • TI-2025-42703 free5GC has Improper Input Validation in UDM, Leading to Information Exposure CVSS 4.0MEDIUM 6.6
See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences