8.7

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-33064

CVE-2026-33064: free5GC UDM DataChangeNotification Procedure Panic Due to Nil Pointer Dereference

Free5GC is an open-source Linux Foundation project for 5th generation (5G) mobile core networks. Versions prior to 1.4.2 are vulnerable to procedure panic caused by Nil Pointer Dereference in the /sdm-subscriptions endpoint. A remote attacker can cause the UDM service to panic and crash by sending a crafted POST request to the /sdm-subscriptions endpoint with a malformed URL path containing path traversal sequences (../) and a large JSON payload. The DataChangeNotificationProcedure function in notifier.go attempts to access a nil pointer without proper validation, causing a complete service crash with "runtime error: invalid memory address or nil pointer dereference". Exploitation would result in UDM functionality disruption until recovery by restart. This issue has been fixed in version 1.4.2.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-33064

CVE-2026-33064:

8.7

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/free5gc/udm	go	< 1.4.2	1.4.2

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a classic nil pointer dereference in the DataChangeNotificationProcedure function located in internal/sbi/processor/notifier.go. The vulnerability description explicitly points to this function. The provided patch in commit 65d7070f4bfd016864cbbaefbd506bbc85d2fa92 confirms this. The original code retrieves a UE context using p.Context().UdmUeFindBySupi(supi) but fails to check if the returned context is nil. An attacker can send a request with a supi that does not correspond to any existing UE, causing the function to receive a nil pointer. Subsequent operations on this nil pointer lead to a panic and a denial of service. The patch rectifies this by checking the boolean returned by UdmUeFindBySupi and returning early if the UE context is not found. The HTTP handler Server.HandleDataChangeNotificationToNF in internal/sbi/api_httpcallback.go is the entry point that forwards the request to the vulnerable function, making it a key part of the exploitation path.

Vulnerable functions

processor.DataChangeNotificationProcedure

internal/sbi/processor/notifier.go

The function `DataChangeNotificationProcedure` in `internal/sbi/processor/notifier.go` is vulnerable to a nil pointer dereference. The original code did not check if a UE context was found for the given `supi`. If `p.Context().UdmUeFindBySupi(supi)` returned no UE, the `ue` variable would be `nil`, and subsequent access to it would cause a panic. The patch adds a check to ensure the UE context exists before proceeding.

Server.HandleDataChangeNotificationToNF

internal/sbi/api_httpcallback.go

This function is the HTTP handler that serves as the entry point for the vulnerability. It receives the malicious request and calls the vulnerable `DataChangeNotificationProcedure`. The patch changes the route to include the `supi` as a path parameter and adds validation, which is part of the fix.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.