PT-2026-26187 · Free5Gc · Free5Gc

Zfei10990-Cmd · Published 2026-03-18 · Updated 2026-03-27 · CVE-2026-33065

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Free5GC versions prior to 1.4.2

Description The UDM component in Free5GC incorrectly handles DELETE requests with an empty supi path parameter. Specifically, when a client sends a DELETE request with an empty supi (e.g., double slashes // in the URL path) to the /sdm-subscriptions endpoint, the UDM forwards the malformed request to the UDR. The UDR correctly returns a 400 Bad Request error, but the UDM incorrectly propagates this as a 500 Internal Server Error (SYSTEM FAILURE) to the client. This behavior leaks internal error handling details and hinders clients from differentiating between client-side and server-side errors, violating REST API best practices for DELETE operations. The affected component is the UDM Nudm SDM service.

Recommendations Upgrade to Free5GC version 1.4.2 or later to resolve this issue. As a temporary workaround, implement API gateway-level validation to reject DELETE requests with empty path parameters before they reach the UDM.

Exploit

Fix

Generation of Error Message Containing Sensitive Information

Weakness Enumeration

CWE-209

Related Identifiers

CVE-2026-33065

GHSA-958M-GXMC-MCCM

GO-2026-4758

SUSE-SU-2026:1135-1

Affected Products

Free5Gc

References · 155

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33065.json · Exploit
• https://github.com/free5gc/free5gc/issues/783 · Vendor Advisory
• https://github.com/free5gc/free5gc/security/advisories/GHSA-958m-gxmc-mccm · Vendor Advisory
• https://github.com/free5gc/udm/commit/88de9fa74a1b3f3522e53b4cfa2d184712ffa4ee · Patch
• https://github.com/free5gc/udm/pull/79 · Patch
• https://osv.dev/vulnerability/GO-2026-4758 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-33065 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-33065 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-958m-gxmc-mccm · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-33065 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-33065 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-33065 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2026:1135-1 · Vendor Advisory
• https://github.com/free5gc/free5gc · Note
• https://suse.com/security/cve/CVE-2026-33525 · Note