CVE-2026-42459: free5GC: Improper Input Validation and Generation of Error Message Containing Sensitive Information in github.com/free5gc/udm

Synopsis

Improper input validation in the free5GC UDM (Unified Data Management) component allows an unauthenticated attacker to inject control characters into the SUPI (Subscriber Permanent Identifier) path parameter across six GET handlers in the nudm-sdm service. The malformed request is forwarded to the UDR (Unified Data Repository), triggering a 500 Internal Server Error response that leaks internal infrastructure details. No fix version has been published upstream yet; HarborGuard tracks the advisory and will make a patched-image rebuild available as soon as a fix is released.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable nudm-sdm GET handlers are exposed over the network, so the attacker must be able to reach the UDM service endpoint across the network.

• AuthenticationNot required

  No credentials or session token are needed; the attacker can send a crafted SUPI parameter as an anonymous, unauthenticated request.

• Victim interactionNot required

  Exploitation is fully attacker-driven and requires no action from any user or operator of the affected system.

• Attack complexityDetail

  The exploit is reliable and condition-free: injecting control characters into a path parameter requires no special timing, memory layout knowledge, or environmental pre-conditions.

Blast Radius

• A successful attacker reads internal infrastructure details (such as internal hostnames, service addresses, or stack traces) returned in the 500 Internal Server Error response body from UDR.
• Exposed infrastructure details can be used to map the internal 5G core topology, accelerating follow-on attacks against UDR or other core network functions.
• Subscriber identity handling paths are disrupted: repeated malformed requests cause UDM to return error responses, degrading the Subscriber Data Management service for legitimate operations.