Vulnerability Description
Free5GC is an open-source Linux Foundation project for 5th generation (5G) mobile core networks. In versions prior to 1.4.2, the UDM incorrectly converts a downstream 400 Bad Request (from UDR) into a 500 Internal Server Error when handling DELETE requests with an empty supi path parameter. This leaks internal error handling behavior and makes it difficult for clients to distinguish between client-side errors and server-side failures. When a client sends a DELETE request with an empty supi (e.g., double slashes // in URL path), the UDM forwards the malformed request to UDR, which correctly returns 400. However, UDM propagates this as 500 SYSTEM_FAILURE instead of returning the appropriate 400 error to the client. This violates REST API best practices for DELETE operations. The issue has been patched in version 1.4.2.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Free5Gc | Udm | < 1.4.2 |
Related Weaknesses (CWE)
References
- https://github.com/free5gc/free5gc/issues/783ExploitIssue TrackingPatch
- https://github.com/free5gc/free5gc/security/advisories/GHSA-958m-gxmc-mccmPatchVendor Advisory
- https://github.com/free5gc/udm/commit/88de9fa74a1b3f3522e53b4cfa2d184712ffa4eePatch
- https://github.com/free5gc/udm/pull/79Issue TrackingPatch
FAQ
What is CVE-2026-33065?
CVE-2026-33065 is a vulnerability with a CVSS score of 5.3 (MEDIUM). Free5GC is an open-source Linux Foundation project for 5th generation (5G) mobile core networks. In versions prior to 1.4.2, the UDM incorrectly converts a downstream 400 Bad Request (from UDR) into a...
How severe is CVE-2026-33065?
CVE-2026-33065 has been rated MEDIUM with a CVSS base score of 5.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-33065?
Check the references section above for vendor advisories and patch information. Affected products include: Free5Gc Udm.