Vulnerability record · CVE-2026-33192 · published 20 March 2026

CVE-2026-33192: Free5gc udm error message information leak vulnerability

Free5gc · Udm

Free5GC is an open-source Linux Foundation project for 5th generation (5G) mobile core networks. In versions prior to 1.4.2, the UDM incorrectly converts a downstream 400 Bad Request (from UDR) into a 500 Internal Server Error when handling PATCH requests with an empty supi path parameter. Additionally, the UDM incorrectly translates the PATCH method to PUT when forwarding to UDR, indicating a deeper architectural issue. This leaks internal error handling behavior, making it difficult for clients to distinguish between client-side errors and server-side failures. The issue has been patched in version 1.4.2.

8.7 CVSS 4.0 High EPSS 0.40% · top 68.3% CWE-209 · Error message information leak

8.7CVSS 4.0 base score

0.40%EPSS exploitation probability, 30 days

NoNot in CISA KEV

1Affected product versions listed by NVD

3References, 1 tagged exploit

17 Jun 2026Last modified by NVD

Description

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

Udm Free5gc

References

Link	Tags
https://github.com/free5gc/free5gc/issues/784	ExploitIssue TrackingPatchVendor Advisory
https://github.com/free5gc/free5gc/security/advisories/GHSA-5rvc-5cwx-g5x8	PatchVendor Advisory
https://github.com/free5gc/udm/pull/79	Issue TrackingPatch

Track CVE-2026-33192 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

8.7CVE-2026-33064Free5gc udm null pointer dereference vulnerabilityFree5GC is an open-source Linux Foundation project for 5th generation (5G) mobile core networks. Versions prior to 1.4.2 are vulnerable to procedure …EPSS 0.78%20 Mar 2026 8.7CVE-2026-33191Free5gc udm vulnerabilityFree5GC is an open-source Linux Foundation project for 5th generation (5G) mobile core networks. Versions prior to 1.4.2 are vulnerable to null byte …EPSS 0.58%20 Mar 2026 7.5CVE-2023-46324Free5gc udm improper verification of cryptographic signature vulnerabilitypkg/suci/suci.go in free5GC udm before 1.2.0, when Go before 1.19 is used, allows an Invalid Curve Attack because it may compute a shared secret via …EPSS 0.41%23 Oct 2023 6.9CVE-2026-33065Free5gc udm error message information leak vulnerabilityFree5GC is an open-source Linux Foundation project for 5th generation (5G) mobile core networks. In versions prior to 1.4.2, the UDM incorrectly conv…EPSS 0.43%20 Mar 2026 6.6CVE-2026-27642Free5gc udm improper input validation vulnerabilityfree5gc UDM provides Unified Data Management (UDM) for free5GC, an open-source project for 5th generation (5G) mobile core networks. In versions up t…EPSS 0.65%24 Feb 2026 6.6CVE-2025-69250Free5gc udm improper input validation vulnerabilityfree5gc UDM provides Unified Data Management (UDM) for free5GC, an open-source project for 5th generation (5G) mobile core networks. In versions up t…EPSS 0.41%24 Feb 2026 6.6CVE-2025-69251Free5gc udm improper input validation vulnerabilityfree5gc UDM provides Unified Data Management (UDM) for free5GC, an open-source project for 5th generation (5G) mobile core networks. In versions up t…EPSS 0.48%24 Feb 2026 6.6CVE-2025-69252Free5gc udm null pointer dereference vulnerabilityfree5gc UDM provides Unified Data Management (UDM) for free5GC, an open-source project for 5th generation (5G) mobile core networks. Versions up to a…EPSS 0.53%24 Feb 2026

Source: NIST National Vulnerability Database (record CVE-2026-33192), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.