PT-2026-21592 · Free5Gc · Free5Gc Udm

Alonza0314 · Published 2026-02-24 · Updated 2026-05-07 · CVE-2026-27642

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions free5gc UDM versions up to and including 1.4.1

Description free5gc UDM provides Unified Data Management for free5GC, an open-source 5G mobile core network project. Remote attackers can inject control characters, such as %00, into the supi parameter. This injection triggers internal URL parsing errors (net/url: invalid control character), potentially exposing system-level error details and enabling service fingerprinting. All deployments of free5GC utilizing the UDM Nudm UEAU service may be affected.

Recommendations Versions up to and including 1.4.1: Apply the official patch from free5gc/udm pull request 75.

Exploit

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2026-27642

GHSA-H4WG-RP7M-8XX4

Affected Products

Free5Gc Udm

References · 14

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/27xxx/CVE-2026-27642.json · Exploit
• https://github.com/free5gc/free5gc/security/advisories/GHSA-h4wg-rp7m-8xx4 · Vendor Advisory
• https://github.com/free5gc/free5gc/issues/749 · Vendor Advisory
• https://github.com/free5gc/udm/commit/a7af2321ddea6368c43835f90f6d1b9d67dd2ea1 · Patch
• https://github.com/free5gc/udm/pull/75 · Patch
• https://osv.dev/vulnerability/CVE-2026-27642 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-27642 · Security Note
• https://twitter.com/dailycve/status/2052258642619965600 · Twitter Post
• https://twitter.com/cracbot/status/2028062757019660649 · Twitter Post
• https://twitter.com/CVEnew/status/2026184661320519685 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2026197371256750583 · Twitter Post
• https://twitter.com/cracbot/status/2027338144769847465 · Twitter Post
• https://t.me/cveNotify/153190 · Telegram Post
• https://twitter.com/cracbot/status/2027700444471169535 · Twitter Post