Security Advisory

CVE-2026-42459

CVE vulnerability detail - eXtreme Datacenter Security Operations

Published 2026-05-27 15:53:45

Last updated 2026-05-28 14:14:46

Assigner GitHub_M

CVSS score 7.7

State PUBLISHED

Description

free5GC is an open-source implementation of the 5G core network. Prior to 4.2.2, the free5GC UDM component fails to validate the supi path parameter in six GET handlers of the nudm-sdm (Subscriber Data Management) service. An unauthenticated attacker can inject control characters into the SUPI parameter, causing UDM to forward a malformed request to UDR and return a 500 Internal Server Error response that exposes internal infrastructure details. This vulnerability is fixed in 4.2.2.

← Browse all CVEs View on cve.org ↗