Null Byte Injection Vulnerability in Free5GC UDM API

CVE-2026-33191

What is CVE-2026-33191?

Free5GC, an open-source project by the Linux Foundation for 5G core networks, is susceptible to a null byte injection vulnerability affecting its UDM's Nudm_SubscriberDataManagement API. Attackers can exploit this vulnerability by injecting URL-encoded null bytes (%00) into the 'supi' path parameter. This results in a failure during URL parsing within the Go programming language’s net/url package, leading to a 500 Internal Server Error. Such exploitation can enable remote denial of service attacks, as improperly formatted URLs cause the UDM to malfunction instead of returning the appropriate error code of 400 Bad Request. The issue has been addressed in version 1.4.2.

References