Is CVE-2026-42459 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-42459 being exploited in the wild.

How severe is CVE-2026-42459?

High severity, with a CVSS score of 7.5, published 27 May 2026.

Which products and versions are affected?

free5GC UDM <= 1.4.3, <= 4.2.1; github.com/free5gc/udm (Go) <= 1.4.3, SEMVER:introduced=0, SEMVER:introduced=0,last_affected=1.4.3.

Is there a fix for CVE-2026-42459?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-42459 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-42459?

Check whether you run free5GC UDM or github.com/free5gc/udm (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-42459: free5GC UDM information disclosure via improper SUPI validation

Q: Which products and versions are affected?

free5GC UDM <= 1.4.3, <= 4.2.1; github.com/free5gc/udm (Go) <= 1.4.3, SEMVER:introduced=0, SEMVER:introduced=0,last_affected=1.4.3.

Q: Is there a fix for CVE-2026-42459?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

Q: How is CVE-2026-42459 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-42459?

Check whether you run free5GC UDM or github.com/free5gc/udm (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-42459 · Severity: high · CVSS 7.5 · Published 2026-05-27

Free5GC UDM, a component used in 5G core networks for managing subscriber data, is vulnerable to information disclosure. An unauthenticated attacker can send specially crafted requests that cause the system to reveal internal network addresses and API structures. This sensitive information could be used to plan more targeted attacks against the internal 5G infrastructure.

Technologies: free5GC UDM, github.com/free5gc/udm (Go). Vendors: free5GC, Go.

Quick answers

Is CVE-2026-42459 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-42459 being exploited in the wild.
How severe is CVE-2026-42459?: High severity, with a CVSS score of 7.5, published 27 May 2026.
Which products and versions are affected?: free5GC UDM <= 1.4.3, <= 4.2.1; github.com/free5gc/udm (Go) <= 1.4.3, SEMVER:introduced=0, SEMVER:introduced=0,last_affected=1.4.3.
Is there a fix for CVE-2026-42459?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-42459 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-42459?: Check whether you run free5GC UDM or github.com/free5gc/udm (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The free5GC UDM component contains an improper input validation vulnerability in six GET handlers within the 'nudm-sdm' service. Specifically, the 'supi' path parameter is not validated using 'validator.IsValidSupi()' before being processed. An unauthenticated remote attacker can inject control characters into this parameter. When UDM attempts to forward the request to the Unified Data Repository (UDR), the Go 'net/url' parser fails and generates an error. UDM then returns a 500 Internal Server Error response that includes the full internal UDR URL, hostname, port, and API path structure in the 'detail' field. This is a regression or missed fix related to CVE-2026-27642.

Affected products

free5gc udm <= 1.4.3

Identifiers

CVE-2026-42459
GHSA-585v-hcgf-jhfr
GO-2026-5138

Timeline

2026-05-07: advisory: GitHub Advisory published
2026-05-27: disclosed: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.