CVE-2026-33064 free5GC UDM DataChangeNotification Procedure Panic Due to Nil Pointer Dereference
Remote attackers can crash the free5GC UDM service by sending crafted requests to the sdm-subscriptions endpoint, causing a denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-33064?
CVE-2026-33064 is a high-severity vulnerability in free5gc, published on 20 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Free5GC is an open-source Linux Foundation project for 5th generation (5G) mobile core networks. Versions prior to 1.4.2 are vulnerable to procedure panic caused by Nil Pointer Dereference in the /sdm-subscriptions endpoint. A remote attacker can cause the UDM service to panic and crash by sending a crafted POST request to the /sdm-subscriptions endpoint with a malformed URL path containing path traversal sequences (../) and a large JSON payload. The DataChangeNotificationProcedure function in notifier.go attempts to access a nil pointer without proper validation, causing a complete service crash with "runtime error: invalid memory address or nil pointer dereference". Exploitation would result in UDM functionality disruption until recovery by restart. This issue has been fixed in version 1.4.2.
Which versions are affected by CVE-2026-33064?
3 open source packages ship an affected version, including github.com/free5gc/udm. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/free5gc/udm Go | All versions | 1.4.2 |
github.com/free5gc/udm Go | All versions | 1.4.2 |
github.com/free5gc/udm Go | All versions | 1.4.2 |
Products include Free5gc Udm.
How do I fix CVE-2026-33064?
Upgrade github.com/free5gc/udm to 1.4.2 or later.
Is CVE-2026-33064 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-33064 exists.
Other vulnerabilities in free5gc
- CVE-2026-33191 free5GC UDM vulnerable to null byte injection in URL path parameters causing 500 Internal Server Error
- CVE-2026-33192 free5GC UDM incorrectly returns 500 for empty supi path parameter in PATCH sdm-subscriptions reques
- CVE-2023-46324 free5GC udm vulnerable to Invalid Curve Attack
- CVE-2026-33065 free5GC UDM incorrectly returns 500 for empty supi path parameter in DELETE sdm-subscriptions request
- CVE-2026-27642 free5GC has Improper Input Validation in UDM UEAU Service
Sources
Also known as GHSA-7g27-v5wj-jr75, GO-2026-4757, ROOT-OS-UBUNTU-2204-CVE-2026-33064.