CVE-2026-33192: 
Linux Ubuntu vulnerability analysis and mitigation

CVE-2026-33192 is an improper error handling vulnerability with information exposure implications in the free5GC Unified Data Management (UDM) component's Nudm_SubscriberDataManagement (Nudm_SDM) service. When a PATCH request is sent to the sdm-subscriptions endpoint with an empty supi path parameter (e.g., double slashes // in the URL), the UDM incorrectly converts a downstream 400 Bad Request from the UDR into a 500 Internal Server Error, leaking internal error handling behavior. Additionally, the UDM incorrectly translates the PATCH HTTP method to PUT when forwarding to the UDR, indicating a deeper architectural flaw. All deployments of free5GC v4.0.1 using the UDM Nudm_SDM service are affected; the patched version is free5GC UDM 1.4.2. The vulnerability carries a CVSS v3.1 score of 5.3 (Medium) and a CVSS v4.0 score of 8.7 (High) (GitHub Advisory).

The root cause is classified as CWE-209 (Generation of Error Message Containing Sensitive Information), stemming from missing input validation on the supi path parameter in the UDM's Nudm_SDM PATCH handler. When an attacker sends a PATCH request with an empty supi (resulting in a double-slash // in the URL path), the UDM fails to validate the parameter and forwards a malformed PUT request to the UDR; the UDR correctly returns HTTP 400, but the UDM propagates this upstream as HTTP 500 SYSTEM_FAILURE rather than the appropriate 400 error. This behavior violates REST API best practices and exposes internal service architecture details to unauthenticated network clients. No authentication or special privileges are required to trigger the issue, and exploitation requires only network access and a crafted HTTP request (GitHub Advisory, free5GC Issue #784).

Successful exploitation allows unauthenticated remote attackers to observe improper HTTP status codes (500 instead of 400), exposing internal error handling behavior and enabling reconnaissance of the 5G core network's internal service architecture. The primary impact is limited confidentiality loss — attackers can infer details about UDM-UDR communication patterns and error propagation logic — with no direct integrity or data modification impact. In the context of 5G core deployments, this information disclosure could facilitate further targeted attacks against the network function service bus (GitHub Advisory, free5GC Issue #784).

1. Reconnaissance: Identify free5GC deployments running version v4.0.1 with the UDM Nudm_SDM service exposed on the network (default port 8000). Confirm the target is reachable and that OAuth is disabled or bypassed for testing.
2. Craft malicious request: Construct a PATCH request targeting the sdm-subscriptions endpoint with an empty supi path parameter by inserting double slashes (//) in the URL path: http://<UDM_IP>:8000/nudm-sdm/v2//sdm-subscriptions/1?supported-features=1a2b.
3. Send the request: Execute the following command against the target UDM:

curl -v -X PATCH "http://127.0.0.3:8000/nudm-sdm/v2//sdm-subscriptions/1?supported-features=1a2b" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  --data '{"expires":"2025-12-22T12:00:00Z","monitoredResourceUris":["1"],"expectedUeBehaviourThresholds":{}}'

4. Observe response: The UDM returns HTTP 500 SYSTEM_FAILURE instead of HTTP 400, confirming the vulnerability and revealing internal error handling behavior and UDM-UDR communication details.
5. Leverage for reconnaissance: Use the observed error patterns to map internal service interactions between UDM and UDR, informing further targeted attacks against the 5G core network (free5GC Issue #784).

• Network: Unexpected PATCH requests to /nudm-sdm/v2//sdm-subscriptions/<id> (note double slash //) from external or untrusted sources targeting UDM port 8000.
• Logs: UDM GIN access logs showing 500 responses to PATCH /nudm-sdm/v2//sdm-subscriptions/ requests; UDR GIN logs showing 400 responses to PUT /nudr-dr/v2/subscription-data//context-data/sdm-subscriptions/<id> (note HTTP method is PUT, not PATCH, and double slash in path).
  • Example UDM log entry: [INFO][UDM][GIN] | 500 | <IP> | PATCH | /nudm-sdm/v2//sdm-subscriptions/1?supported-features=1a2b
  • Example UDR log entry: [INFO][UDR][GIN] | 400 | <IP> | PUT | /nudr-dr/v2/subscription-data//context-data/sdm-subscriptions/1
• Behavioral: Repeated malformed PATCH requests with empty supi parameters (double-slash URLs) from the same source IP, potentially indicating automated scanning or fuzzing activity (free5GC Issue #784).

Users should upgrade the free5GC UDM component to version 1.4.2 or later, which includes the fix implemented in PR free5gc/udm#79 (merged January 20, 2026) that adds input validation in the Sdm handler to reject requests with empty path parameters (GitHub Advisory, UDM PR #79). There is no direct application-level workaround; however, deploying an API gateway or reverse proxy that validates and rejects PATCH requests with empty or malformed supi path parameters before they reach the UDM can serve as a compensating control. Network-level access controls restricting who can reach the UDM SBI interface (port 8000) are also recommended as a defense-in-depth measure.

The vulnerability was reported by community researcher zfei10990-cmd via the free5GC GitHub issue tracker on January 6, 2026, and the fix was contributed by wiwi878 and merged by maintainer Alonza0314 on January 20, 2026 (UDM PR #79). The fix was part of a broader patch addressing multiple related input validation issues in the UDM (issues #779, #780, #783, and #784). No significant broader media coverage or notable security researcher commentary beyond the GitHub issue and advisory has been identified.