CVE-2026-33064: 
Linux Ubuntu vulnerability analysis and mitigation

CVE-2026-33064 is a NULL Pointer Dereference vulnerability in the free5GC Unified Data Management (UDM) service that allows unauthenticated remote attackers to crash the service via a crafted HTTP request, resulting in a Denial of Service (DoS). It affects all deployments of free5GC using the github.com/free5gc/udm Go module prior to version 1.4.2 (corresponding to free5GC v4.0.1 and earlier). The vulnerability was reported on January 6, 2026, and publicly disclosed via GitHub Advisory GHSA-7g27-v5wj-jr75 on March 18, 2026. It carries a CVSS v3.1 base score of 7.5 (High) and a CVSS v4.0 base score of 8.7 (High) (GitHub Advisory).

The root cause is a NULL Pointer Dereference (CWE-476) combined with a Missing Default Case in a conditional expression (CWE-478) in the DataChangeNotificationProcedure function located in notifier.go (line 30). The vulnerable route was registered as /sdm-subscriptions without requiring a supi path parameter, allowing an attacker to send a POST request to a path like /nudm-sdm/v2/../../sdm-subscriptions — using path traversal sequences (../) — which bypasses normal routing and causes the function to call UdmUeFindBySupi with an empty or nil SUPI. The return value was not checked for validity (ok was ignored), so the code proceeded to dereference a nil ue pointer, triggering a Go runtime panic (runtime error: invalid memory address or nil pointer dereference). A large, malformed JSON payload in the request body is used to ensure the request reaches the vulnerable code path (GitHub Advisory, Bug Report).

Successful exploitation causes the UDM service to panic and crash completely, disrupting all UDM functionality — including subscriber data management, authentication support, and session management — until the service is manually restarted. There is no confidentiality or integrity impact; the vulnerability is purely an availability issue. In a 5G core network deployment, a crashed UDM can prevent user equipment registration, authentication, and session establishment, effectively causing a network-wide outage for all connected subscribers (GitHub Advisory, Bug Report).

1. Reconnaissance: Identify internet-facing or network-accessible free5GC deployments running UDM version prior to 1.4.2 (free5GC v4.0.1). Check for open HTTP ports (default: 8000) on the UDM service address (e.g., 127.0.0.3 in default configs).
2. Disable OAuth if testing locally: In a test environment, set oauth: false in nrfcfg.yaml to remove authentication requirements (production deployments may already lack proper network-level access controls).
3. Craft the malicious request: Construct a POST request targeting the /sdm-subscriptions endpoint using a path traversal sequence to bypass the expected route pattern:

   curl -v -X POST "http://<UDM_IP>:8000/nudm-sdm/v2/../../sdm-subscriptions?shared-data-ids=%5B%221%22%5D" \
     -H "Accept: application/json" \
     -H "Content-Type: application/json" \
     --data '{"callbackReference":"1",...,"nfInstanceId":"d7dbe7c3-dd91-4636-9fc2-ee699576d7f7",...}'

4. Trigger the nil pointer dereference: The path traversal causes the router to match the /sdm-subscriptions route without a valid supi parameter. The DataChangeNotificationProcedure function calls UdmUeFindBySupi with an empty SUPI, receives a nil pointer, and dereferences it without validation.
5. Achieve DoS: The UDM service panics with runtime error: invalid memory address or nil pointer dereference and crashes, returning HTTP 500 and requiring manual restart to restore service (Bug Report, GitHub Advisory).

• Network: Unexpected HTTP POST requests to /sdm-subscriptions (without a preceding SUPI path segment) or paths containing ../ sequences targeting the UDM service port (default 8000); requests with unusually large JSON payloads to the UDM HTTP callback endpoint.
• Logs: UDM log entries showing [INFO][UDM][Callback] Handle DataChangeNotificationToNF immediately followed by [ERRO][UDM][GIN] panic: runtime error: invalid memory address or nil pointer dereference; HTTP 500 responses logged for POST requests to /sdm-subscriptions; goroutine stack traces referencing notifier.go:30 and DataChangeNotificationProcedure.
• Process: Unexpected termination/restart of the udm process; Go runtime panic output in UDM stderr or log files containing the string invalid memory address or nil pointer dereference and stack frames from github.com/free5gc/udm/internal/sbi/processor.
• Service Availability: Sudden loss of UDM service availability (connection refused or no response on UDM SBI port) requiring manual intervention to restart (Bug Report).

Upgrade the github.com/free5gc/udm module to version 1.4.2 or later, which includes the fix from PR free5gc/udm#78 (commit 65d7070). The patch adds SUPI validation, checks the return value of UdmUeFindBySupi before dereferencing, validates NotifyItems presence, and corrects the route pattern to /:supi/sdm-subscriptions to enforce proper path parameter extraction. As a temporary workaround where patching is not immediately possible, implement API gateway or reverse proxy rules to block HTTP requests containing path traversal sequences (../) targeting the UDM SBI endpoint (GitHub Advisory, Patch Commit).

The vulnerability was published by free5GC maintainer Alonza0314 via the GitHub Security Advisory system on March 18, 2026, and the fix was merged on March 2, 2026 — prior to public disclosure. The issue was also picked up by the Go vulnerability database (golang/vulndb#4757) and flagged by GoVulnBot. Coverage appeared on CVE aggregation platforms including cvefeed.io and INCIBE-CERT shortly after NVD publication on March 20, 2026 (GitHub Advisory, Bug Report).