CVE-2026-47780: free5GC is an open-source implementation of the 5G core network. In 4.2.3 and earlier, HandleCreateEeSubscriptions and HandleQueryeesubscrip

Executive brief

free5GC UDR is a data repository used in 5G core networks to store subscriber information. A flaw in how it validates user identifiers allows an attacker to inject and store arbitrary, non-standard data into the database. This can lead to persistent data corruption, unauthorized record creation, and potential issues for other network components that rely on accurate subscriber data.

Technical details

An improper input validation vulnerability exists in the free5GC UDR EE subscription handlers (HandleCreateEeSubscriptions and HandleQueryeesubscriptions) within api_datarepository.go. The validation logic uses a regular expression for the 'ueId' parameter that contains a trailing catch-all branch (.|.+), effectively matching any non-empty string. An attacker with network access to the UDR Service Based Interface (SBI) can submit requests with arbitrary identifiers that bypass intended 3GPP format restrictions (e.g., IMSI, MSISDN). These identifiers are successfully persisted in the backend database and can be retrieved via GET requests, leading to unauthorized data creation and potential integrity issues for downstream components.

Affected products

• free5gc udr <= 1.4.3

Timeline

• 2026-06-10: disclosed
• 2026-06-11: advisory

References

• https://api.github.com/users/Giancannella
• https://github.com/Giancannella
• https://api.github.com/users/Giancannella/gists%7B/gist_id%7D
• https://api.github.com/users/Giancannella/repos
• https://avatars.githubusercontent.com/u/56028149?v=4
• https://api.github.com/users/Giancannella/events%7B/privacy%7D