CVE-2026-33065: Free5gc Udm Information Disclosure Bug

CVE-2026-33065 Overview

CVE-2026-33065 is an Information Disclosure vulnerability affecting Free5GC, an open-source Linux Foundation project for 5th generation (5G) mobile core networks. The vulnerability exists in the Unified Data Management (UDM) component where improper error handling during DELETE request processing leaks internal system behavior to external clients.

In versions prior to 1.4.2, the UDM incorrectly converts downstream 400 Bad Request responses from the Unified Data Repository (UDR) into 500 Internal Server Error responses when handling DELETE requests containing an empty supi path parameter. This improper error transformation leaks internal error handling logic and violates REST API best practices.

Critical Impact

This vulnerability enables attackers to fingerprint internal system architecture and error handling behavior in 5G core networks, potentially aiding in further reconnaissance and attack planning.

Affected Products

• Free5GC UDM versions prior to 1.4.2
• 5G mobile core network deployments using vulnerable Free5GC components
• Systems with exposed Free5GC UDM API endpoints

Discovery Timeline

• March 20, 2026 - CVE-2026-33065 published to NVD
• March 23, 2026 - Last updated in NVD database

Technical Details for CVE-2026-33065

Vulnerability Analysis

This vulnerability stems from improper error handling in the Free5GC UDM component, classified as CWE-209 (Generation of Error Message Containing Sensitive Information). When a client sends a malformed DELETE request containing an empty supi parameter (such as a URL with double slashes //), the UDM forwards this invalid request downstream to the UDR component.

The UDR correctly identifies the malformed input and returns an HTTP 400 Bad Request response, which is the appropriate client error response. However, the UDM component fails to properly propagate this client error code. Instead, it transforms the 400 response into a 500 Internal Server Error with a SYSTEM_FAILURE message before returning it to the original client.

This error transformation has two significant security implications. First, it exposes internal error handling logic by revealing that the UDM forwards requests to downstream components and how it processes their responses. Second, it masks the true nature of errors, making it impossible for legitimate clients to distinguish between actual server-side failures and simple client input errors.

Root Cause

The root cause lies in the UDM's subscriber data management validation logic. The component lacks proper input validation at the API boundary for the supi parameter, and subsequently fails to correctly map downstream error responses to appropriate client-facing HTTP status codes. The fix, implemented in version 1.4.2, updates the github.com/free5gc/util dependency from version 1.3.2-0.20260102062829-eaf663340255 to 1.3.2-0.20260107090449-c09baaf75b11, which includes improved input validation and error handling.

Attack Vector

The attack is network-based and requires no authentication or user interaction. An attacker can exploit this vulnerability by sending specially crafted HTTP DELETE requests to the UDM API endpoint with an empty or malformed supi path parameter. By analyzing the 500 SYSTEM_FAILURE responses instead of expected 400 errors, attackers can map internal service boundaries and error handling patterns within the 5G core network infrastructure.

// Security patch in go.mod - Dependency update for validation fix
 require (
 	github.com/asaskevich/govalidator v0.0.0-20210307081110-f21760c49a8d
 	github.com/free5gc/openapi v1.2.3
-	github.com/free5gc/util v1.3.2-0.20260102062829-eaf663340255
+	github.com/free5gc/util v1.3.2-0.20260107090449-c09baaf75b11
 	github.com/gin-gonic/gin v1.10.0
 	github.com/google/uuid v1.6.0
 	github.com/h2non/gock v1.2.0

Source: GitHub Commit

Detection Methods for CVE-2026-33065

Indicators of Compromise

• Unusual HTTP DELETE requests to UDM endpoints containing double slashes (//) or empty path segments in the supi parameter
• Elevated counts of 500 Internal Server Error responses from UDM services that should be returning 400 Bad Request errors
• Sequential probing requests to UDM API endpoints with various malformed path parameters

Detection Strategies

• Monitor HTTP access logs for DELETE requests with malformed URL patterns targeting subscriber data management endpoints
• Implement anomaly detection rules to identify reconnaissance activity involving systematic API probing
• Correlate UDM 500 error responses with UDR 400 responses to detect the error transformation behavior

Monitoring Recommendations

• Enable detailed logging on Free5GC UDM and UDR components to capture complete request/response cycles
• Deploy web application firewall (WAF) rules to detect and block requests with malformed URL path patterns
• Implement rate limiting on UDM API endpoints to mitigate automated reconnaissance attempts

How to Mitigate CVE-2026-33065

Immediate Actions Required

• Upgrade Free5GC to version 1.4.2 or later immediately to apply the security fix
• Review access controls on UDM API endpoints and restrict access to trusted network segments only
• Audit recent logs for any evidence of exploitation attempts involving malformed DELETE requests

Patch Information

The vulnerability has been patched in Free5GC version 1.4.2. The fix is implemented through an updated github.com/free5gc/util dependency (version 1.3.2-0.20260107090449-c09baaf75b11) that includes proper input validation for the supi parameter and correct error code propagation. Organizations should review the GitHub Security Advisory and the GitHub Pull Request for complete patch details.

Workarounds

• Implement input validation at the API gateway or reverse proxy level to reject DELETE requests with empty or malformed supi parameters before they reach the UDM
• Deploy network segmentation to limit direct access to Free5GC UDM endpoints from untrusted networks
• Configure custom error pages at the load balancer level to mask internal error details until the patch can be applied

# Example nginx configuration to block malformed supi requests
location ~ ^/nudm-sdm/v[0-9]+//.*$ {
    return 400 '{"error": "Bad Request - Invalid path"}';
}

location ~ ^/nudm-sdm/v[0-9]+/[^/]+/.*$ {
    proxy_pass http://udm_backend;
}