CVE-2026-42459
Description
free5GC is an open-source implementation of the 5G core network. Prior to 4.2.2, the free5GC UDM component fails to validate the supi path parameter in six GET handlers of the nudm-sdm (Subscriber Data Management) service. An unauthenticated attacker can inject control characters into the SUPI parameter, causing UDM to forward a malformed request to UDR and return a 500 Internal Server Error response that exposes internal infrastructure details. This vulnerability is fixed in 4.2.2.
Predictions
Heuristic predictions, AS-IS, for prioritization only.
Mitigations
No mitigations published for this CVE yet.
The vendor-content worker queues fetches as references arrive (check back in a few minutes). Or — if you've already worked around this in production — publish your fix to the community-verified tier.
✚ Propose a mitigation on Community → Mitigations published via the community go through AI scoring + 2 human reviewers + 7-day silent objection window before landing here withsource_tier=community-verified.
Package impact
| Ecosystem | Package | Vulnerable | Fixed |
|---|---|---|---|
| Go | github.com/free5gc/udm | <=1.4.3 | |
| GO | github.com/free5gc/udm | <= 1.4.3 | |
Application impact
| Vendor | Product | Versions | Fixed |
|---|---|---|---|
| free5gc | free5gc | {"endExcluding":"4.2.2"} | 4.2.2 |
References
- https://github.com/free5gc/free5gc/security/advisories/GHSA-585v-hcgf-jhfr
- https://github.com/free5gc/free5gc/security/advisories/GHSA-h4wg-rp7m-8xx4
- https://github.com/free5gc/free5gc
- https://github.com/free5gc/udm/blob/v1.4.3/internal/sbi/api_subscriberdatamanagement.go
- https://github.com/advisories/GHSA-585v-hcgf-jhfr
CWEs
CWE-20 CWE-209
Community-verified mitigations for this CVE will appear above when contributors publish them.
Verify integrity in audit chain (admin only). AS-IS.