Suse CVE-2026-33191

Remote unauthenticated attacker can inject null bytes (%00) into the 'supi' path parameter of 5G UDM's Nudm_SubscriberDataManagement API. No victim interaction required. Affects default UDM deployments exposing this API endpoint to network access.

The real-world risk is moderate to high for organizations running free5GC v4.0.1 in production 5G core networks. The vulnerability requires remote network access to the UDM API but no authentication or user interaction, making it readily exploitable for denial of service attacks against critical telecommunications infrastructure. While no CVSS score has been formally assigned and no EPSS or KEV data is available, the presence of a public security advisory (GHSA-p9hg-pq3q-v9gv) with detailed exploitation information and a readily available patch indicates awareness in the security community. The technical impact is limited to denial of service rather than data compromise, but service availability is critical for 5G core networks. The low attack complexity (simple null byte injection) and remote attack vector elevate priority, though the specialized nature of 5G core network deployments limits the attack surface to operators and enterprises running free5GC specifically.

An attacker with network access to the free5GC UDM service sends a crafted HTTP request to the Nudm_SubscriberDataManagement API endpoint (e.g., /nudm-sdm/v2/imsi-001010000000000%00/am-data) where the 'supi' parameter contains URL-encoded null bytes. The UDM service fails to validate the input and attempts to construct a URL for the UDR containing the null character, causing Go's net/url parser to reject it with an 'invalid control character' error. The request returns HTTP 500 Internal Server Error, and repeated exploitation can render the UDM service effectively unavailable, disrupting subscriber data management operations across the 5G core network.