free5GC is an open-source implementation of the 5G core network. Prior to 4.2.2, the free5GC UDM component fails to validate the supi path parameter in six GET handlers of the nudm-sdm (Subscriber Data Management) service. An unauthenticated attacker can inject control characters into the SUPI parameter, causing UDM to forward a malformed request to UDR and return a 500 Internal Server Error response that exposes internal infrastructure details. This vulnerability is fixed in 4.2.2.
Fix
Patch, vendor advisory and mitigation references on NVD 2
- https://github.com/free5gc/free5gc/security/advisories/GHSA-585v-hcgf-jhfr Exploit, Mitigation, Vendor Advisory
- https://github.com/free5gc/free5gc/security/advisories/GHSA-585v-hcgf-jhfr Exploit, Mitigation, Vendor Advisory
Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.
Change history 1
- First seenCVSS 7.7 · free5gcNVD modified 2026-10-14 20:10
Affected (CPE criteria) 1
cpe:2.3:a:free5gc:free5gc:*:*:*:*:*:*:*:*
References 2
- https://github.com/free5gc/free5gc/security/advisories/GHSA-585v-hcgf-jhfr Exploit, Mitigation, Vendor Advisory
- https://github.com/free5gc/free5gc/security/advisories/GHSA-585v-hcgf-jhfr Exploit, Mitigation, Vendor Advisory