CVE-2026-33191: 
Linux Ubuntu vulnerability analysis and mitigation

CVE-2026-33191 is a null byte injection vulnerability (Improper Input Validation) in the free5GC UDM (User Data Management) component's Nudm_SubscriberDataManagement API. A remote, unauthenticated attacker can inject null bytes (URL-encoded as %00) into the supi path parameter of Nudm_SDM endpoints, causing Go's net/url package to reject the URL with an "invalid control character in URL" error and return a 500 Internal Server Error, enabling denial of service. All deployments of free5GC v4.0.1 using the UDM Nudm_SDM service with path parameters (e.g., /nudm-sdm/v2/{supi}/am-data) are affected; the fix is present in free5GC UDM versions 1.4.2 and later. It carries a CVSS v3.1 base score of 8.6 (High) and a CVSS v4.0 base score of 8.7 (High) (GitHub Advisory).

The root cause is improper neutralization of null bytes in URL path parameters (CWE-158) combined with an uncaught exception when Go's URL parser encounters control characters (CWE-248). When a request arrives at a Nudm_SDM endpoint, the UDM extracts the supi path parameter without validating it for null bytes or other control characters, then attempts to construct a downstream URL to the UDR that includes the raw parameter value. Go's net/url package strictly rejects URLs containing control characters, throwing an error that propagates as an unhandled 500 Internal Server Error rather than a properly validated 400 Bad Request. The fix (commit 88de9fa, PR free5gc/udm#79) adds explicit SUPI/GPSI format validation using validator.IsValidSupi() and validator.IsValidGpsi() before any URL construction, returning a structured 400 response for invalid inputs (GitHub Advisory, Patch Commit).

Successful exploitation results in a denial of service against the UDM service: each crafted request causes a 500 Internal Server Error, disrupting subscriber data management operations for all UEs served by the affected UDM instance. There is no confidentiality or integrity impact — the vulnerability does not expose subscriber data or allow unauthorized modification. In 5G core network deployments, sustained DoS against the UDM can prevent UE authentication, registration, and session establishment, potentially affecting service availability for all subscribers on the network (GitHub Advisory).

1. Reconnaissance: Identify internet-facing or network-accessible free5GC deployments running UDM versions prior to 1.4.2, using network scanning tools or service discovery targeting 5G core SBI ports.
2. Identify target endpoint: Locate Nudm_SDM API endpoints that include the supi path parameter, such as /nudm-sdm/v2/{supi}/am-data, /nudm-sdm/v2/{supi}/smf-select-data, or similar.
3. Craft malicious request: Construct an HTTP GET request substituting a null byte (URL-encoded as %00) into the supi path parameter, e.g.:

   GET /nudm-sdm/v2/imsi-001010000000001%00/am-data HTTP/1.1
   Host: <udm-host>:<port>

4. Send request: Transmit the crafted request to the UDM SBI interface. The UDM will attempt to construct a downstream URL to the UDR containing the null byte, which Go's net/url parser rejects.
5. Achieve DoS: The UDM returns a 500 Internal Server Error. Repeating this request in rapid succession disrupts UDM availability, preventing legitimate UE subscriber data management operations (GitHub Advisory, Patch Commit).

• Network: Repeated HTTP requests to Nudm_SDM endpoints (e.g., /nudm-sdm/v2/*/am-data) containing %00 in the path parameter from unexpected source IPs; elevated rate of requests to UDM SBI ports from a single source.
• Logs: UDM application logs showing frequent 500 Internal Server Error responses on Nudm_SDM endpoints; Go runtime error messages containing "invalid control character in URL" in UDM service logs; log entries from SdmLog with warnings about invalid SUPI (post-patch: "Supi is invalid").
• Process/Service: Unexpected spikes in UDM error rates or service restarts; downstream UDR connectivity errors triggered by malformed URL construction in UDM logs.

Upgrade free5GC UDM to version 1.4.2 or later, which includes the fix implemented in commit 88de9fa (PR free5gc/udm#79) adding proper SUPI/GPSI format validation before URL construction (GitHub Advisory, Patch Commit). There is no direct application-level workaround without applying the patch. As an interim measure, deploy API gateway-level filtering to reject any HTTP requests containing null bytes (%00) in path parameters before they reach the UDM service.