Remote Code Injection in free5GC UDM by free5GC

CVE-2026-27642

What is CVE-2026-27642?

The free5GC Unified Data Management (UDM) component is susceptible to a vulnerability that allows remote attackers to inject control characters into the 'supi' parameter. This can trigger URL parsing errors, revealing sensitive system-level error information and enabling potential attackers to perform service fingerprinting. All instances of free5GC using the Nudm_UEAU service could be compromised. To mitigate this issue, users should apply the official patches available in the free5GC repositories as no direct workaround exists at the application level.

References