8.7

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-33191

CVE-2026-33191: free5GC UDM vulnerable to null byte injection in URL path parameters causing 500 Internal Server Error

Free5GC is an open-source Linux Foundation project for 5th generation (5G) mobile core networks. Versions prior to 1.4.2 are vulnerable to null byte injection in URL path parameters. A remote attacker can inject null bytes (URL-encoded as %00) into the supi path parameter of the UDM's Nudm_SubscriberDataManagement API. This causes URL parsing failure in Go's net/url package with the error "invalid control character in URL", resulting in a 500 Internal Server Error. This null byte injection vulnerability can be exploited for denial of service attacks. When the supi parameter contains null characters, the UDM attempts to construct a URL for UDR that includes these control characters. Go's URL parser rejects them, causing the request to fail with 500 instead of properly validating input and returning 400 Bad Request. This issue has been fixed in version 1.4.2.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-33191

CVE-2026-33191:

8.7

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/free5gc/udm	go	< 1.4.2	1.4.2

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in the lack of input validation for path parameters in several HTTP handlers of the free5GC UDM's Nudm_SubscriberDataManagement API. The core issue is that user-provided identifiers from the URL path (like 'supi' and 'ueId') were used without being sanitized. An attacker could inject a URL-encoded null byte (%00) into these parameters. When the application later attempted to use these tainted identifiers to construct a new URL for a request to a downstream service (the UDR), Go's net/url library would correctly reject the string due to the invalid control character. This rejection resulted in an unhandled error, causing the server to return a 500 Internal Server Error and effectively crashing the request processing, leading to a denial of service. The patch addresses this by introducing validation checks at the beginning of each affected HTTP handler (HandleGetAmData, HandleUnsubscribe, HandleModify, HandleGetIdTranslationResult) to ensure that the identifiers conform to the expected format before they are processed.

Vulnerable functions

Server.HandleGetAmData

internal/sbi/api_subscriberdatamanagement.go

This function handles GET requests for a subscriber's access and mobility subscription data. It retrieves the 'supi' (Subscription Permanent Identifier) from the URL path. Prior to the patch, this function did not validate the 'supi' parameter. An attacker could provide a URL-encoded null byte ('%00') in the 'supi', which would be passed down to backend services. This would cause an 'invalid control character in URL' error when constructing a request to the UDR (Unified Data Repository), resulting in a 500 Internal Server Error and a denial of service.

Server.HandleUnsubscribe

internal/sbi/api_subscriberdatamanagement.go

This function handles requests to unsubscribe from notifications. It retrieves the 'ueId' (UE Identity), which can be a SUPI or GPSI, from the URL path. Before the patch, it lacked validation for this parameter. A null byte injected into the 'ueId' would be passed to the `UnsubscribeProcedure`, leading to a crash when constructing subsequent requests, causing a denial of service.

Server.HandleModify

internal/sbi/api_subscriberdatamanagement.go

This function handles requests to modify a subscription. It retrieves the 'ueId' from the URL path. Similar to other handlers, it was vulnerable to null byte injection because it did not validate the 'ueId' before using it. This could cause the `ModifyProcedure` to fail when processing the invalid identifier, resulting in a denial of service.

Server.HandleGetIdTranslationResult

internal/sbi/api_subscriberdatamanagement.go

This function handles requests for identifier translation (e.g., GPSI to SUPI). It retrieves the 'ueId' from the URL path. The lack of input validation on the 'ueId' parameter made it vulnerable to null byte injection. An invalid 'ueId' would be passed to the `GetIdTranslationResultProcedure`, causing a failure and denial of service.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.