Executive brief
free5GC is an open-source 5G mobile network core software. A flaw in the Subscriber Data Management (SDM) component causes the service to crash when receiving HTTP requests with a missing 'supported-features' query parameter. An attacker can send crafted requests to render the UDM (User Data Management) service unavailable, disrupting mobile subscriber authentication and data services.
Technical details
The vulnerability is an out-of-bounds array access in the HandleGetSharedData function of free5GC's UDM SDM module. The function assumes the 'supported-features' query parameter is present and attempts to access its first element (supportedFeatures[0]) without validating slice length or presence. When the parameter is omitted or empty, a Go runtime panic ("index out of range") is triggered, crashing the service and causing a denial of service. Attack vector is network-based; no authentication is required. A simple HTTP GET request to /nudm-sdm/v2/shared-data without the query parameter is sufficient to trigger the crash. Patches are expected to add proper validation of the supportedFeatures slice before access.
Affected products
- free5GC free5GC v4.0.1
Timeline
- 2026-01-01: disclosed: Bug reported on GitHub issue #762
- 2026-08-27: advisory: CVE-2026-30070 published