Executive brief
A vulnerability exists in free5GC's Unified Data Repository (UDR), a component used in 5G core networks to manage subscriber data. An authenticated user can cause the service to crash or return error messages by sending a specifically crafted request to delete subscription data that does not exist. While the system automatically recovers from each crash, a repeated attack could degrade the performance and availability of the subscriber database.
Technical details
A NULL pointer dereference (CWE-476) exists in the free5GC UDR 'nudr-dr' service within the 'RemoveAmfSubscriptionsInfoProcedure' handler. The vulnerability is triggered when a DELETE request is made to the '/subscription-data/{ueId}/{servingPlmnId}/ee-subscriptions/{subsId}/amf-subscriptions' endpoint with a non-existent 'subsId' after UE state has been initialized. The code identifies the missing subscription and prepares a 404 error but fails to return, subsequently attempting to access a member of the nil subscription object. This results in a panic that is caught by the Gin recovery middleware, returning an HTTP 500 error. An attacker with a valid OAuth2 access token can repeatedly trigger this panic to cause a denial-of-service. The issue is fixed in version 1.4.3.
Affected products
- free5GC udr < 1.4.3
Timeline
- 2026-03-22: other: Vulnerability validated in lab environment
- 2026-05-08: advisory: GitHub Advisory published
- 2026-05-27: other: NVD published CVE-2026-44323