CVE-2026-33065: 
Linux Ubuntu vulnerability analysis and mitigation

CVE-2026-33065 is an improper error handling vulnerability with information exposure implications in the free5GC Unified Data Management (UDM) component. When a DELETE request is sent to the sdm-subscriptions endpoint with an empty supi path parameter (e.g., double slashes // in the URL), the UDM incorrectly converts a downstream 400 Bad Request response from the UDR into a 500 Internal Server Error, leaking internal error handling behavior. The vulnerability affects github.com/free5gc/udm versions prior to 1.4.2, specifically free5GC v4.0.1 deployments using the Nudm_SDM service. It was first reported on January 6, 2026, and publicly disclosed via GitHub Advisory on March 18, 2026. The CVSS v3.1 base score is 5.3 (Medium) and the CVSS v4.0 base score is 6.9 (Medium) (GitHub Advisory).

The root cause is classified as CWE-209 (Generation of Error Message Containing Sensitive Information) — the UDM fails to validate the supi path parameter before forwarding DELETE requests to the UDR, and does not properly propagate the UDR's 400 Bad Request response back to the client. Instead, the UDM returns a 500 SYSTEM_FAILURE response, exposing internal error handling logic. The attack vector is network-based, requires no authentication or user interaction, and is triggered by crafting a DELETE request with an empty supi (e.g., DELETE /nudm-sdm/v2//sdm-subscriptions/1). The fix, implemented in PR free5gc/udm#79 (commit 88de9fa), adds input validation using validator.IsValidSupi() and validator.IsValidGpsi() checks before processing requests, returning a proper 400 with cause MANDATORY_IE_INCORRECT when the parameter is invalid (GitHub Advisory, Fix Commit).

Successful exploitation allows an unauthenticated remote attacker to probe the internal error handling behavior of the free5GC UDM service, distinguishing between client-side and server-side failures in ways not intended by the API design. The confidentiality impact is low — no subscriber data or credentials are directly exposed — but the leaked error semantics could assist an attacker in mapping the internal architecture of a 5G core network deployment. Integrity and availability are not impacted by this vulnerability (GitHub Advisory, Issue #783).

1. Reconnaissance: Identify free5GC deployments running version v4.0.1 with the UDM Nudm_SDM service exposed, particularly those with OAuth disabled for testing or misconfiguration purposes.
2. Craft malformed request: Construct a DELETE HTTP request targeting the sdm-subscriptions endpoint with an empty supi path parameter by inserting double slashes in the URL path (e.g., /nudm-sdm/v2//sdm-subscriptions/1).
3. Send the request: Execute the request against the UDM service: curl -v -X DELETE "http://<UDM_IP>:8000/nudm-sdm/v2//sdm-subscriptions/1" -H "Accept: application/json"
4. Observe error response: The UDM returns a 500 Internal Server Error with SYSTEM_FAILURE cause instead of a 400 Bad Request, confirming the vulnerability and revealing internal error propagation behavior.
5. Probe system internals: Repeat with variations in path parameters or subscription IDs to map internal service behavior and distinguish between different failure modes, aiding further reconnaissance of the 5G core network (Issue #783).

• Network: Unexpected DELETE requests to /nudm-sdm/v2//sdm-subscriptions/<id> (note double slashes) originating from external or untrusted IP addresses targeting the UDM SBI port (default 8000).
• Logs: UDM GIN access logs showing 500 responses to DELETE requests on /nudm-sdm/v2//sdm-subscriptions/ paths; UDR GIN logs showing 400 responses to corresponding /nudr-dr/v2/subscription-data//context-data/sdm-subscriptions/ requests immediately preceding the UDM 500 response.
• Log Example: [INFO][UDR][GIN] | 400 | 127.0.0.1 | DELETE | /nudr-dr/v2/subscription-data//context-data/sdm-subscriptions/1 followed by [INFO][UDM][GIN] | 500 | 127.0.0.1 | DELETE | /nudm-sdm/v2//sdm-subscriptions/1 (Issue #783).

Users should upgrade github.com/free5gc/udm to version 1.4.2 or later, which includes the fix from PR free5gc/udm#79 (commit 88de9fa74a1b3f3522e53b4cfa2d184712ffa4ee). There is no direct application-level workaround; however, as an interim measure, operators can implement API gateway-level validation to reject DELETE requests with empty or malformed path parameters before they reach the UDM service. Restricting access to the UDM SBI interface to trusted internal 5G core network components only will also reduce exposure (GitHub Advisory, Fix PR).