6.9

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-33065

CVE-2026-33065: free5GC UDM incorrectly returns 500 for empty supi path parameter in DELETE sdm-subscriptions request

Free5GC is an open-source Linux Foundation project for 5th generation (5G) mobile core networks. In versions prior to 1.4.2, the UDM incorrectly converts a downstream 400 Bad Request (from UDR) into a 500 Internal Server Error when handling DELETE requests with an empty supi path parameter. This leaks internal error handling behavior and makes it difficult for clients to distinguish between client-side errors and server-side failures. When a client sends a DELETE request with an empty supi (e.g., double slashes // in URL path), the UDM forwards the malformed request to UDR, which correctly returns 400. However, UDM propagates this as 500 SYSTEM_FAILURE instead of returning the appropriate 400 error to the client. This violates REST API best practices for DELETE operations. The issue has been patched in version 1.4.2.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-33065

CVE-2026-33065:

6.9

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/free5gc/udm	go	< 1.4.2	1.4.2

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability CVE-2026-33065 describes an improper error handling issue in the free5GC UDM service. Specifically, when a DELETE request is sent to the sdm-subscriptions endpoint with an empty supi path parameter, the service returns a 500 Internal Server Error instead of the correct 400 Bad Request. This leaks information about the internal workings of the service.

The analysis of the provided patch commit 88de9fa74a1b3f3522e53b4cfa2d184712ffa4ee reveals changes in the file internal/sbi/api_subscriberdatamanagement.go. The commit adds input validation to several HTTP handler functions.

The primary vulnerable function is Server.HandleUnsubscribe, which is the handler for the DELETE /sdm-subscriptions/:ueId/:subscriptionId route. The patch explicitly adds a validation block to check if the ueId parameter is a valid SUPI or GPSI. Before this change, an empty ueId would be passed down to the business logic (UnsubscribeProcedure), triggering the incorrect error propagation.

Additionally, the same patch applies similar validation fixes to other handler functions (HandleGetAmData, HandleModify, HandleGetIdTranslationResult) within the same file. Although the CVE description focuses on the DELETE request, these functions were also missing crucial input validation for user-provided identifiers (supi, ueId), making them susceptible to similar improper error handling vulnerabilities. Therefore, they are included as vulnerable functions that are fixed by the same patch.

Vulnerable functions

Server.HandleUnsubscribe

internal/sbi/api_subscriberdatamanagement.go

This function handles DELETE requests to the `/sdm-subscriptions/{ueId}/{subscriptionId}` endpoint. Before the patch, it did not validate the `ueId` path parameter. An empty `ueId` would be passed to the `UnsubscribeProcedure`, causing the UDM to incorrectly propagate a downstream 400 Bad Request as a 500 Internal Server Error, thus exposing internal error handling details.

Server.HandleGetAmData

internal/sbi/api_subscriberdatamanagement.go

This function handles GET requests for AM data. The patch adds validation for the `supi` parameter. Prior to the patch, an invalid or empty SUPI could be passed to the processor, potentially leading to similar improper error handling or other unexpected behavior.

Server.HandleModify

internal/sbi/api_subscriberdatamanagement.go

This function handles PATCH requests to modify subscriptions. The patch adds validation for the `ueId` parameter. Before this fix, an invalid or empty `ueId` could be passed to the `ModifyProcedure`, likely causing similar improper error handling as seen in the primary vulnerability.

Server.HandleGetIdTranslationResult

internal/sbi/api_subscriberdatamanagement.go

This function handles GET requests for ID translation results. The patch adds validation for the `ueId` parameter, which can be a GPSI or SUPI. Without this validation, an invalid identifier could be passed to the `GetIdTranslationResultProcedure`, leading to unhandled errors or information leakage.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.