CVE-2026-33191: Free5gc Udm DOS Vulnerability

CVE-2026-33191 Overview

CVE-2026-33191 is a null byte injection vulnerability affecting Free5GC, an open-source Linux Foundation project implementing 5th generation (5G) mobile core networks. The vulnerability exists in the UDM (Unified Data Management) component's Nudm_SubscriberDataManagement API, where inadequate input validation allows remote attackers to inject null bytes into URL path parameters, resulting in denial of service conditions.

When a remote attacker injects null bytes (URL-encoded as %00) into the supi path parameter, Go's net/url package fails to parse the malformed URL with an "invalid control character in URL" error. This causes the UDM to return a 500 Internal Server Error instead of properly validating the input and returning a 400 Bad Request, effectively disrupting service availability.

Critical Impact

Remote attackers can disrupt 5G mobile core network operations by exploiting null byte injection in the UDM component, causing service outages for subscriber data management functions.

Affected Products

• Free5GC UDM versions prior to 1.4.2
• 5G mobile core deployments using vulnerable Free5GC implementations
• Systems relying on the Nudm_SubscriberDataManagement API

Discovery Timeline

• 2026-03-20 - CVE-2026-33191 published to NVD
• 2026-03-23 - Last updated in NVD database

Technical Details for CVE-2026-33191

Vulnerability Analysis

This vulnerability represents an improper input validation issue classified under CWE-158 (Improper Neutralization of Null Byte or NUL Character). The flaw exists in how the Free5GC UDM component processes the supi parameter within its subscriber data management API endpoints.

When processing API requests, the UDM component constructs URLs to communicate with the UDR (Unified Data Repository). The vulnerability arises because the supi parameter is incorporated into these URLs without proper sanitization of control characters. Go's net/url package strictly rejects URLs containing null bytes and other control characters, causing URL parsing to fail catastrophically rather than being handled gracefully.

The impact is a denial of service condition where legitimate subscriber data management operations fail due to the application's inability to properly handle malformed input. This is particularly concerning in 5G telecommunications infrastructure where service availability is critical.

Root Cause

The root cause is insufficient input validation in the Nudm_SubscriberDataManagement API handlers. The supi path parameter accepts arbitrary input including URL-encoded null bytes (%00) without sanitization before being used in URL construction. When these control characters reach Go's URL parser, the strict validation causes an unrecoverable error that propagates as a 500 Internal Server Error.

The fix implemented in version 1.4.2 updates the github.com/free5gc/util dependency to include proper validation that rejects control characters early in the request processing pipeline, returning an appropriate 400 Bad Request response instead.

Attack Vector

This vulnerability is exploitable over the network without authentication. An attacker can craft HTTP requests to the UDM's subscriber data management endpoints with null byte sequences injected into the supi path parameter. The attack requires no privileges and no user interaction, making it a low-complexity attack suitable for automated exploitation or integration into denial of service campaigns targeting 5G infrastructure.

The security patch updates the github.com/free5gc/util dependency to add input validation:

 require (
 	github.com/asaskevich/govalidator v0.0.0-20210307081110-f21760c49a8d
 	github.com/free5gc/openapi v1.2.3
-	github.com/free5gc/util v1.3.2-0.20260102062829-eaf663340255
+	github.com/free5gc/util v1.3.2-0.20260107090449-c09baaf75b11
 	github.com/gin-gonic/gin v1.10.0
 	github.com/google/uuid v1.6.0
 	github.com/h2non/gock v1.2.0

Source: GitHub Commit Reference

Detection Methods for CVE-2026-33191

Indicators of Compromise

• HTTP requests to UDM endpoints containing URL-encoded null bytes (%00) in path parameters
• Elevated frequency of 500 Internal Server Error responses from UDM subscriber data management APIs
• Log entries containing "invalid control character in URL" error messages from Go's net/url package
• Abnormal patterns of requests targeting /nudm-sdm/ API paths with malformed supi values

Detection Strategies

• Deploy web application firewalls (WAF) with rules to detect and block null byte injection patterns in URL paths
• Implement API gateway validation to reject requests containing control characters before they reach backend services
• Configure intrusion detection systems (IDS) to alert on patterns matching %00 sequences in HTTP request URIs
• Monitor UDM service health metrics for sudden spikes in 500 error responses

Monitoring Recommendations

• Enable detailed access logging on UDM components to capture full request URIs including path parameters
• Set up alerting thresholds for 5xx error rates on subscriber data management endpoints
• Implement anomaly detection for unusual request patterns targeting the Nudm_SubscriberDataManagement API
• Monitor network traffic for repeated requests from single sources with malformed path parameters

How to Mitigate CVE-2026-33191

Immediate Actions Required

• Upgrade Free5GC UDM component to version 1.4.2 or later immediately
• Review network logs for evidence of exploitation attempts targeting the supi parameter
• Implement input validation at the API gateway or load balancer layer to reject null bytes in path parameters
• Consider temporarily restricting access to UDM endpoints to trusted network segments if patching is delayed

Patch Information

The vulnerability has been addressed in Free5GC UDM version 1.4.2. The fix involves updating the github.com/free5gc/util dependency from version v1.3.2-0.20260102062829-eaf663340255 to v1.3.2-0.20260107090449-c09baaf75b11, which includes proper input validation for control characters. The patch commit is available at GitHub Commit 88de9fa.

For full details, refer to the GitHub Security Advisory GHSA-p9hg-pq3q-v9gv.

Workarounds

• Deploy a reverse proxy or API gateway that sanitizes URL paths by rejecting requests containing %00 or other control characters
• Implement network-level access controls to limit UDM API access to authorized internal services only
• Configure WAF rules to block requests matching patterns like /nudm-sdm/.*%00.* in the URI path
• Monitor and rate-limit requests to subscriber data management endpoints to reduce DoS impact

# Example nginx configuration to block null bytes in URI
location /nudm-sdm/ {
    if ($request_uri ~* "%00") {
        return 400;
    }
    proxy_pass http://udm-backend;
}