8.7

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-33192

CVE-2026-33192: free5GC UDM incorrectly returns 500 for empty supi path parameter in PATCH sdm-subscriptions reques

Free5GC is an open-source Linux Foundation project for 5th generation (5G) mobile core networks. In versions prior to 1.4.2, the UDM incorrectly converts a downstream 400 Bad Request (from UDR) into a 500 Internal Server Error when handling PATCH requests with an empty supi path parameter. Additionally, the UDM incorrectly translates the PATCH method to PUT when forwarding to UDR, indicating a deeper architectural issue. This leaks internal error handling behavior, making it difficult for clients to distinguish between client-side errors and server-side failures. The issue has been patched in version 1.4.2.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-33192

CVE-2026-33192:

8.7

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/free5gc/udm	go	< 1.4.2	1.4.2

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is rooted in improper error handling and information exposure within the free5GC UDM service, specifically when processing HTTP requests with malformed path parameters. The core issue lies in several HTTP handler functions within internal/sbi/api_subscriberdatamanagement.go that failed to validate the supi or ueId path parameters before passing them to downstream business logic.

The primary function identified, Server.HandleModify, which corresponds to the PATCH sdm-subscriptions endpoint mentioned in the advisory, would accept requests with an empty ueId (e.g., from a URL like .../sdm-subscriptions//sub123). This empty identifier was passed to the ModifyProcedure, causing an error in a subsequent request to the UDR service. Instead of propagating the 400 Bad Request from the UDR, the UDM incorrectly converted it to a 500 Internal Server Error, leaking internal error state and violating API best practices.

The provided patch addresses this by introducing input validation at the beginning of HandleModify and other related handlers (HandleGetAmData, HandleUnsubscribe, HandleGetIdTranslationResult). By checking if the supi or ueId is valid before any processing occurs, the patched code can immediately return a proper 400 Bad Request for malformed requests, thus preventing the downstream error and the resulting information leak.

Vulnerable functions

Server.HandleModify

internal/sbi/api_subscriberdatamanagement.go

This function handles PATCH requests to modify a subscription. The vulnerability lies in the lack of validation for the `ueId` path parameter. Before the patch, an empty `ueId` (e.g., from a URL with `//`) was passed directly to the `ModifyProcedure`. This would cause a downstream request to the UDR to fail, but the UDM would incorrectly return a 500 Internal Server Error instead of a 400 Bad Request. The patch adds a validation check to ensure `ueId` is a valid SUPI or GPSI, returning a 400 error if it's not.

Server.HandleGetAmData

internal/sbi/api_subscriberdatamanagement.go

This function retrieves AM data for a subscriber. It was vulnerable due to missing validation on the `supi` path parameter. An invalid SUPI could be passed to downstream processing, potentially causing unhandled errors. The patch adds validation to ensure the `supi` format is correct before proceeding.

Server.HandleUnsubscribe

internal/sbi/api_subscriberdatamanagement.go

This function handles subscription removal. It was vulnerable due to missing validation on the `ueId` path parameter, which could be a SUPI or GPSI. An invalid identifier would be passed to the `UnsubscribeProcedure`, leading to potential downstream errors. The patch adds validation for the `ueId`.

Server.HandleGetIdTranslationResult

internal/sbi/api_subscriberdatamanagement.go

This function handles identifier translation requests. It was vulnerable due to missing validation on the `ueId` path parameter. An invalid identifier would be passed to the `GetIdTranslationResultProcedure`, leading to potential downstream errors. The patch adds validation for the `ueId`.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.