5G Mobile Core Network Vulnerability in Free5GC by Linux Foundation

CVE-2026-33192

What is CVE-2026-33192?

Free5GC, an open-source project for 5G mobile core networks, contains a vulnerability where the User Data Management (UDM) component mishandles PATCH requests with an empty 'supi' path parameter. Instead of properly responding with a client-side error (400 Bad Request), it incorrectly returns a server error (500 Internal Server Error). This misbehavior indicates a potential architectural flaw, as the UDM inappropriately converts PATCH requests to PUT requests when communicating with the User Data Repository (UDR). Such issues can lead to confusion for clients unable to differentiate between client-side errors and server failures. The vulnerability has been addressed in version 1.4.2.

References