Medium severity · published Apr 21, 2026
CVE-2026-40343
free5GC UDR: Fail-open handling in PolicyDataSubsToNotifyPost allows unintended subscription creation
5.8
CVSS
8.6%
EPSS
No
On KEV
Description
free5GC UDR is the user data repository (UDR) for free5GC, an an open-source project for 5th generation (5G) mobile core networks. In versions up to and including 1.4.2, a fail-open request handling flaw in the UDR service causes the `/nudr-dr/v2/policy-data/subs-to-notify` POST handler to continue processing requests even after request body retrieval or deserialization errors. This may allow unintended creation of Policy Data notification subscriptions with invalid, empty, or partially processed input, depending on downstream processor behavior. As of time of publication, a patched version is not available.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)8.6% · higher than 95% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
UD
udr · free5gc
<= 1.4.2 · source: vendor, NVD
FR
Free5gc · Free5gc
through 4.2.1 · source: NVD
Affected product
UD
udr
free5gc
More from udr
5.3
CVE-2026-27643
free5GC has improper error handling in NEF with information exposure
5.3
CVE-2025-69253
free5GC vulnerable to improper error handling in NEF with information exposure
5.3
CVE-2025-69208
free5GC UDR's NEF incorrectly returns 500 for missing PFD data (UDR 404) in Nnef_PfdManagement GET request