CVE-2026-33065 Details
Description
Free5GC is an open-source Linux Foundation project for 5th generation (5G) mobile core networks. In versions prior to 1.4.2, the UDM incorrectly converts a downstream 400 Bad Request (from UDR) into a 500 Internal Server Error when handling DELETE requests with an empty supi path parameter. This leaks internal error handling behavior and makes it difficult for clients to distinguish between client-side errors and server-side failures. When a client sends a DELETE request with an empty supi (e.g., double slashes // in URL path), the UDM forwards the malformed request to UDR, which correctly returns 400. However, UDM propagates this as 500 SYSTEM_FAILURE instead of returning the appropriate 400 error to the client. This violates REST API best practices for DELETE operations. The issue has been patched in version 1.4.2.
A vulnerability exists in the Free5GC UDM component, specifically within the Nudm_SubscriberDataManagement API, in versions prior to 1.4.2. The issue arises when DELETE requests are sent to the sdm-subscriptions endpoint with an empty supi path parameter, such as double slashes in the URL. In this scenario, the UDM incorrectly translates a 400 Bad Request response from the UDR into a 500 Internal Server Error, labeled as SYSTEM_FAILURE. This mismanagement of error responses obscures the distinction between client-side and server-side errors, violating REST API best practices for DELETE operations.
Users should upgrade to Free5GC version 1.4.2 or later, where this vulnerability has been patched. The fix involves adding validation to ensure that the supi path parameter is not empty before forwarding DELETE requests to the UDR.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 20, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/free5gc/free5gc/issues/783 | [email protected] | ExploitIssue TrackingPatchVendor Advisory |
| https://github.com/free5gc/free5gc/security/advisories/GHSA-958m-gxmc-mccm | [email protected] | PatchVendor Advisory |
| https://github.com/free5gc/udm/commit/88de9fa74a1b3f3522e53b4cfa2d184712ffa4ee | [email protected] | Patch |
| https://github.com/free5gc/udm/pull/79 | [email protected] | Issue TrackingPatch |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-209 | Generation of Error Message Containing Sensitive Information | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| free5gc udm | < 1.4.2 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Mar 23, 2026 | Initial Analysis | [email protected] |
| Mar 20, 2026 | New CVE Received | [email protected] |