PT-2026-21593 · Free5Gc · Free5Gc

Zfei10990-Cmd · Published 2026-02-24 · Updated 2026-02-25 · CVE-2026-27643

Positive Technologies (AI Summary)

CVSS v4.0

6.6

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U

Name of the Vulnerable Software and Affected Versions free5GC versions prior to 1.4.2

Description The free5GC UDR component, a user data repository for 5G mobile core networks, exhibits an information disclosure issue. The NEF component reveals internal parsing error details to remote clients, potentially aiding attackers in service fingerprinting. This affects all deployments of free5GC utilizing the Nnef PfdManagement service. The issue stems from the reliable leakage of parsing errors, such as invalid characters, to external entities.

Recommendations Apply the patch available in free5gc/udr pull request 56.

Exploit

Fix

Generation of Error Message Containing Sensitive Information

Weakness Enumeration

CWE-209

Related Identifiers

CVE-2026-27643

GHSA-6468-F87J-6G82

Affected Products

Free5Gc

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/27xxx/CVE-2026-27643.json · Exploit
• https://github.com/free5gc/free5gc/security/advisories/GHSA-6468-f87j-6g82 · Patch
• https://github.com/free5gc/free5gc/issues/753 · Vendor Advisory
• https://github.com/free5gc/udr/pull/56 · Patch
• https://github.com/free5gc/udr/commit/754d23b03755ad59077ed529ce3b971e477080c4 · Patch
• https://osv.dev/vulnerability/CVE-2026-27643 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-27643 · Security Note
• https://t.me/cveNotify/153168 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2026187131442417665 · Twitter Post
• https://twitter.com/CVEnew/status/2026184660401992093 · Twitter Post