Medium severity · published Mar 20, 2026
CVE-2026-33065
free5GC UDM incorrectly returns 500 for empty supi path parameter in DELETE sdm-subscriptions request
5.3
CVSS
0.3%
EPSS
No
On KEV
Description
Free5GC is an open-source Linux Foundation project for 5th generation (5G) mobile core networks. In versions prior to 1.4.2, the UDM incorrectly converts a downstream 400 Bad Request (from UDR) into a 500 Internal Server Error when handling DELETE requests with an empty supi path parameter. This leaks internal error handling behavior and makes it difficult for clients to distinguish between client-side errors and server-side failures. When a client sends a DELETE request with an empty supi (e.g., double slashes // in URL path), the UDM forwards the malformed request to UDR, which correctly returns 400. However, UDM propagates this as 500 SYSTEM_FAILURE instead of returning the appropriate 400 error to the client. This violates REST API best practices for DELETE operations. The issue has been patched in version 1.4.2.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 21% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FR
free5gc · free5gc
< 1.4.2 · source: vendor
UD
Udm · Free5gc
before 1.4.2 · source: NVD
Affected product
FR
free5gc
free5gc
More from free5gc
10.0
CVE-2026-44327
free5GC: NEF nnef-oam route group is unauthenticated; no-token requests reach the OAM handler
10.0
CVE-2026-44329
free5GC: SMF UPI management interface lacks auth middleware; unauthenticated topology read/write requests reach handlers
10.0
CVE-2026-44330
free5GC: NEF nnef-pfdmanagement API is unauthenticated; forged bearer tokens can read PFD data and create/delete PFD subscriptions
9.4
CVE-2026-44315
free5GC: NEF 3gpp-pfd-management API is unauthenticated; forged bearer tokens can create, read, and delete PFD transactions
9.4
CVE-2026-44326
free5GC: NEF 3gpp-traffic-influence API is unauthenticated; missing or forged bearer tokens can create, read, patch, and delete subscriptions