CVE-2026-27643: Free5gc UDR Information Disclosure Flaw

CVE-2026-27643 Overview

CVE-2026-27643 is an information disclosure vulnerability in free5GC, an open-source 5th generation (5G) mobile core network project. The flaw resides in the User Data Repository (UDR) component, specifically affecting the Network Exposure Function (NEF) when handling requests to the Nnef_PfdManagement service. Versions up to and including 1.4.1 return verbose internal parsing error details, such as invalid character 'n' after top-level value, to remote clients. This exposure assists attackers in service fingerprinting and reconnaissance against 5G core deployments. The issue is tracked under CWE-209: Generation of Error Message Containing Sensitive Information.

Critical Impact

Remote, unauthenticated attackers can extract internal parsing error details from the NEF component, enabling service fingerprinting of free5GC 5G core deployments running the Nnef_PfdManagement service.

Affected Products

• free5GC UDR versions up to and including 1.4.1
• Any free5GC deployment using the Nnef_PfdManagement service
• 5G core network deployments based on the free5gc/udr Go module

Discovery Timeline

• 2026-02-24 - CVE-2026-27643 published to NVD
• 2026-02-25 - Last updated in NVD database

Technical Details for CVE-2026-27643

Vulnerability Analysis

The vulnerability stems from improper handling of error responses in the NEF component of free5GC. When the Nnef_PfdManagement service receives malformed input, the parser propagates internal Go runtime error messages directly to the remote client. These errors include JSON decoding diagnostics that reveal byte-level parsing context and internal data structure expectations. An attacker can leverage these responses to identify the underlying library, fingerprint the deployed version, and prepare further targeted attacks against the 5G core. While the disclosure does not directly grant code execution or authentication bypass, it weakens the operational security of telecom infrastructure.

Root Cause

The root cause is the absence of error message sanitization in the NEF's PFD (Packet Flow Description) management handler. The implementation forwards parser-generated strings to HTTP responses without translating them into generic, client-safe messages. This pattern is classified under CWE-209, where sensitive internal state is included in error output returned to untrusted callers.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker sends crafted, malformed payloads to the Nnef_PfdManagement endpoint exposed by free5GC. The service responds with verbose parsing errors that disclose internal implementation details. Repeated probing enables an attacker to map the 5G core's exposed service functions and identify the precise free5GC release in use.

No verified public exploit code is available for this issue. See the free5gc Security Advisory GHSA-6468-f87j-6g82 for technical details.

Detection Methods for CVE-2026-27643

Indicators of Compromise

• HTTP responses from the NEF service containing parser error strings such as invalid character 'n' after top-level value or similar Go JSON decoder messages
• Repeated malformed requests to Nnef_PfdManagement endpoints from a single source
• Anomalous reconnaissance traffic targeting 5G core service-based interfaces (SBI)

Detection Strategies

• Inspect NEF access logs for HTTP 4xx responses containing verbose Go-runtime error text returned to external clients
• Deploy signatures on API gateways to flag JSON parser error patterns leaving the 5G core's NEF interfaces
• Correlate enumeration patterns against the Nnef_PfdManagement resource path with subsequent probing of adjacent network functions

Monitoring Recommendations

• Continuously monitor service-based interface (SBI) traffic for malformed payloads targeting the NEF
• Aggregate UDR and NEF logs into a centralized analytics platform to identify reconnaissance patterns
• Alert on repeated parsing failures originating from non-trusted Application Function (AF) sources

How to Mitigate CVE-2026-27643

Immediate Actions Required

• Apply the patch from free5gc/udr pull request #56 referenced in commit 754d23b
• Upgrade free5GC UDR to a version newer than 1.4.1 that contains the fix
• Restrict network exposure of the NEF Nnef_PfdManagement endpoint to trusted Application Functions only

Patch Information

The maintainers merged the fix via free5gc/udr pull request #56, tracked in commit 754d23b03755ad59077ed529ce3b971e477080c4. The associated advisory is published as GHSA-6468-f87j-6g82, and the original report is in free5gc issue #753. Operators must rebuild and redeploy the UDR binary after applying the patch.

Workarounds

• No direct application-level workaround exists; applying the upstream patch is required per the maintainer guidance
• Place a reverse proxy or API gateway in front of the NEF to strip verbose error bodies before they reach external clients
• Limit access to service-based interfaces through network segmentation and mutual TLS between 5G network functions

# Configuration example: build patched free5GC UDR from source
git clone https://github.com/free5gc/udr.git
cd udr
git checkout 754d23b03755ad59077ed529ce3b971e477080c4
go build -o bin/udr cmd/main.go