Read the docs
TI-2026-25616 Aliases CVE-2026-33191GHSA-p9hg-pq3q-v9gv

free5GC UDM vulnerable to null byte injection in URL path parameters causing 500 Internal Server Error

Priority MEDIUM 44CWE-158Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-248.

Summary

Free5GC is an open-source Linux Foundation project for 5th generation (5G) mobile core networks. Versions prior to 1.4.2 are vulnerable to null byte injection in URL path parameters. A remote attacker can inject null bytes (URL-encoded as %00) into the supi path parameter of the UDM's Nudm_SubscriberDataManagement API. This causes URL parsing failure in Go's net/url package with the error "invalid control character in URL", resulting in a 500 Internal Server Error. This null byte injection vulnerability can be exploited for denial of service attacks. When the supi parameter contains null characters, the UDM attempts to construct a URL for UDR that includes these control characters. Go's URL parser rejects them, causing the request to fail with 500 instead of properly validating input and returning 400 Bad Request. This issue has been fixed in version 1.4.2.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00368 30th percentileScored 2026-11-07
Fix Fixed free5gc (free5gc): 1.4.2github.com/free5gc/udm (Go): 1.4.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
free5gcfree5gcbefore 1.4.21.4.2Patch availableCNA
—github.com/free5gc/udm (Go)before 1.4.21.4.2Patch availableGHSA-p9hg-pq3q-v9gv
  • free5gc Vendorfree5gc Affected before 1.4.2 Fixed in 1.4.2 Patch available CNA
  • github.com/free5gc/udm (Go) Vendor— Affected before 1.4.2 Fixed in 1.4.2 Patch available GHSA-p9hg-pq3q-v9gv

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:free5gc:udm:*:*:*:*:*:go:*:*before 1.4.2Vulnerablefree5gc
  • cpe:2.3:a:free5gc:udm:*:*:*:*:*:go:*:* Versions before 1.4.2 Vulnerable ·free5gc

Remediation

  • Fix · CNA free5gc (free5gc) Fixed in 1.4.2
  • Fix · GHSA-p9hg-pq3q-v9gv github.com/free5gc/udm (Go) Fixed in 1.4.2 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-33191
  2. 2026-10-03 Alias added: GHSA-p9hg-pq3q-v9gv

References

Patch 2

Advisory 1

Other 2

  • TI-2026-25617 free5GC UDM incorrectly returns 500 for empty supi path parameter in PATCH sdm-subscriptions reques CVSS 4.0HIGH 8.7
  • TI-2026-25506 free5GC UDM DataChangeNotification Procedure Panic Due to Nil Pointer Dereference CVSS 4.0HIGH 8.7
  • TI-2026-25507 free5GC UDM incorrectly returns 500 for empty supi path parameter in DELETE sdm-subscriptions request CVSS 4.0MEDIUM 6.9
  • TI-2026-22024 free5GC has Improper Input Validation in UDM UEAU Service CVSS 4.0MEDIUM 6.6
  • TI-2025-42704 free5GC has Null Pointer Dereference in UDM, Leading to Service Panic CVSS 4.0MEDIUM 6.6
  • TI-2025-42703 free5GC has Improper Input Validation in UDM, Leading to Information Exposure CVSS 4.0MEDIUM 6.6
See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences