Miggo at BlackHat 2026!
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability is a denial-of-service caused by a panic in free5GC's UDR component. The root cause is improper error handling within the RemoveAmfSubscriptionsInfoProcedure function. When a DELETE request is sent to the /nudr-dr/v2/subscription-data/{ueId}/{servingPlmnId}/ee-subscriptions/{subsId}/amf-subscriptions endpoint with a ueId that does not exist in the system, the code correctly identifies the error condition but fails to stop execution. It proceeds to perform a Go type assertion on a nil interface variable, which is an unrecoverable condition that causes the application to panic. The fix, evidenced in commit 8a1d3c63be99, involves adding a return statement to exit the function after the error is detected and handled, preventing the panic. The analysis identified both the function where the panic occurs, (*Processor).RemoveAmfSubscriptionsInfoProcedure, and its immediate caller, the HTTP handler (*Server).HandleRemoveAmfSubscriptionsInfo, as they would both be present in a runtime stack trace during exploitation.
(*Processor).RemoveAmfSubscriptionsInfoProcedureinternal/sbi/processor/event_amf_subscription_info_document.go
(*Server).HandleRemoveAmfSubscriptionsInfointernal/sbi/api_datarepository.go
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/free5gc/udr | go | < 1.4.3 | 1.4.3 |