TI-2026-25507 Aliases CVE-2026-33065 GHSA-958m-gxmc-mccm

free5GC UDM incorrectly returns 500 for empty supi path parameter in DELETE sdm-subscriptions request

HIGH 70CWE-209Published 2026-03-20 · Updated 2026-03-20

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Attack requirements: None
Impact type: Information disclosure
Confidentiality · integrity · availability: Low · None · None
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-209.

Summary

Free5GC is an open-source Linux Foundation project for 5th generation (5G) mobile core networks. In versions prior to 1.4.2, the UDM incorrectly converts a downstream 400 Bad Request (from UDR) into a 500 Internal Server Error when handling DELETE requests with an empty supi path parameter. This leaks internal error handling behavior and makes it difficult for clients to distinguish between client-side errors and server-side failures. When a client sends a DELETE request with an empty supi (e.g., double slashes // in URL path), the UDM forwards the malformed request to UDR, which correctly returns 400. However, UDM propagates this as 500 SYSTEM_FAILURE instead of returning the appropriate 400 error to the client. This violates REST API best practices for DELETE operations. The issue has been patched in version 1.4.2.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00294 22nd percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Fixed free5gc (free5gc): 1.4.2github.com/free5gc/udm (Go): 1.4.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: Yes
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
free5gc	free5gc	before 1.4.2	1.4.2	Patch available	CNA
—	github.com/free5gc/udm (Go)	before 1.4.2	1.4.2	Patch available	GHSA-958m-gxmc-mccm

free5gc Vendorfree5gc Affected before 1.4.2 Fixed in 1.4.2 Patch available CNA
github.com/free5gc/udm (Go) Vendor— Affected before 1.4.2 Fixed in 1.4.2 Patch available GHSA-958m-gxmc-mccm

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:free5gc:udm::::::go::*	before 1.4.2	Vulnerable	free5gc

cpe:2.3:a:free5gc:udm:*:*:*:*:*:go:*:* Versions before 1.4.2 Vulnerable ·free5gc

Remediation

Fix · CNA free5gc (free5gc) Fixed in 1.4.2
Fix · GHSA-958m-gxmc-mccm github.com/free5gc/udm (Go) Fixed in 1.4.2 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2026-33065
2026-10-03 Alias added: GHSA-958m-gxmc-mccm

References

Exploit 1

https://github.com/free5gc/free5gc/issues/783

Patch 3

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2026-33065

Other 1

https://github.com/free5gc/free5gc

TI-2026-25617 free5GC UDM incorrectly returns 500 for empty supi path parameter in PATCH sdm-subscriptions reques CVSS 4.0HIGH 8.7
TI-2026-25506 free5GC UDM DataChangeNotification Procedure Panic Due to Nil Pointer Dereference CVSS 4.0HIGH 8.7
TI-2026-25616 free5GC UDM vulnerable to null byte injection in URL path parameters causing 500 Internal Server Error CVSS 4.0HIGH 8.7
TI-2026-22024 free5GC has Improper Input Validation in UDM UEAU Service CVSS 4.0MEDIUM 6.6
TI-2025-42704 free5GC has Null Pointer Dereference in UDM, Leading to Service Panic CVSS 4.0MEDIUM 6.6
TI-2025-42703 free5GC has Improper Input Validation in UDM, Leading to Information Exposure CVSS 4.0MEDIUM 6.6

See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences