Executive brief
free5GC UDM vulnerable to null byte injection in URL path parameters causing 500 Internal Server Error in github.com/free5gc/udm
Affected products
- Go github.com/free5gc/udm
Junglewise Threat Intelligence
CVE-2026-33191: GO-2026-4763 - free5GC UDM vulnerable to null byte injection in URL path parameters causing 500 Internal Server Error in github.com/free5gc/udm
CVE-2026-33191 · Severity: medium · CVSS 4 · Published 2026-03-23
Technologies: github.com/free5gc/udm (Go). Vendors: Go.
Related threats
- free5GC UDM information disclosure via improper SUPI validation
- GO-2026-4758 - free5GC UDM incorrectly returns 500 for empty supi path parameter in DELETE sdm-subscriptions request in github.com/free5gc/udm
- GO-2026-4755 - free5GC UDM incorrectly returns 500 for empty supi path parameter in PATCH sdm-subscriptions reques in github.com/free5gc/udm
- GO-2026-4757 - free5GC UDM DataChangeNotification Procedure Panic Due to Nil Pointer Dereference in github.com/free5gc/udm
- GO-2025-4162 - Free5GC is vulnerable to DoS via the Nudm_SubscriberDataManagement API in github.com/free5gc/openapi