CVE-2026-33191 Details
Description
Free5GC is an open-source Linux Foundation project for 5th generation (5G) mobile core networks. Versions prior to 1.4.2 are vulnerable to null byte injection in URL path parameters. A remote attacker can inject null bytes (URL-encoded as %00) into the supi path parameter of the UDM's Nudm_SubscriberDataManagement API. This causes URL parsing failure in Go's net/url package with the error "invalid control character in URL", resulting in a 500 Internal Server Error. This null byte injection vulnerability can be exploited for denial of service attacks. When the supi parameter contains null characters, the UDM attempts to construct a URL for UDR that includes these control characters. Go's URL parser rejects them, causing the request to fail with 500 instead of properly validating input and returning 400 Bad Request. This issue has been fixed in version 1.4.2.
A null byte injection vulnerability has been identified in Free5GC versions prior to 1.4.2, specifically within the User Data Management (UDM) component's Nudm_SubscriberDataManagement API. This vulnerability allows remote attackers to inject null bytes, URL-encoded as %00, into the supi path parameter. The injection causes a URL parsing failure in Go's net/url package, leading to a 500 Internal Server Error. This issue can be exploited to perform denial-of-service attacks, as the UDM fails to properly validate the injected null characters before constructing URLs for the User Data Repository (UDR). All deployments of Free5GC v4.0.1 using the UDM Nudm_SDM service with endpoints that include path parameters are affected.
Users are advised to upgrade to Free5GC version 1.4.2 or later, where this vulnerability has been fixed. The patch is available in the Free5GC UDM repository.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 20, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-158 | Improper Neutralization of Null Byte or NUL Character | [email protected] |
| CWE-248 | Uncaught Exception | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| free5gc udm | < 1.4.2 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Mar 23, 2026 | Initial Analysis | [email protected] |
| Mar 20, 2026 | New CVE Received | [email protected] |