MEDIUM6.5Go
GHSA-3j9f-7w24-pcqg· CVE-2025-60633, GO-2025-4162Free5GC is vulnerable to DoS via the Nudm_SubscriberDataManagement API
Modified: 12/17/2025
package
Go/github.com/free5gc/udm
pkg:go/github.com/free5gc/udm
HIGH7.5Go
GHSA-585v-hcgf-jhfr· CVE-2026-42459, GO-2026-5138Free5GC UDM has Improper Input Validation and Generation of Error Messages Containing Sensitive Information
Modified: 6/25/2026
HIGHGo
GHSA-5rvc-5cwx-g5x8· CVE-2026-33192, GO-2026-4755free5GC UDM incorrectly returns 500 for empty supi path parameter in PATCH sdm-subscriptions reques
Modified: 3/23/2026
HIGHGo
GHSA-7g27-v5wj-jr75· CVE-2026-33064, GO-2026-4757free5GC UDM DataChangeNotification Procedure Panic Due to Nil Pointer Dereference
Modified: 3/23/2026
MEDIUMGo
GHSA-958m-gxmc-mccm· CVE-2026-33065, GO-2026-4758free5GC UDM incorrectly returns 500 for empty supi path parameter in DELETE sdm-subscriptions request
Modified: 3/23/2026
HIGH7.5Go
GHSA-cqvv-r3g3-26rf· CVE-2023-46324free5GC udm vulnerable to Invalid Curve Attack
Modified: 11/8/2023
HIGHGo
GHSA-p9hg-pq3q-v9gv· CVE-2026-33191, GO-2026-4763free5GC UDM vulnerable to null byte injection in URL path parameters causing 500 Internal Server Error
Modified: 3/23/2026
—Go
GO-2025-4162· CVE-2025-60633, GHSA-3j9f-7w24-pcqgFree5GC is vulnerable to DoS via the Nudm_SubscriberDataManagement API in github.com/free5gc/openapi
Modified: 3/3/2026
—Go
GO-2026-4755· CVE-2026-33192, GHSA-5rvc-5cwx-g5x8free5GC UDM incorrectly returns 500 for empty supi path parameter in PATCH sdm-subscriptions reques in github.com/free5gc/udm
Modified: 3/23/2026
—Go
GO-2026-4757· CVE-2026-33064, GHSA-7g27-v5wj-jr75free5GC UDM DataChangeNotification Procedure Panic Due to Nil Pointer Dereference in github.com/free5gc/udm
Modified: 3/23/2026
—Go
GO-2026-4758· CVE-2026-33065, GHSA-958m-gxmc-mccmfree5GC UDM incorrectly returns 500 for empty supi path parameter in DELETE sdm-subscriptions request in github.com/free5gc/udm
Modified: 3/23/2026
—Go
GO-2026-4763· CVE-2026-33191, GHSA-p9hg-pq3q-v9gvfree5GC UDM vulnerable to null byte injection in URL path parameters causing 500 Internal Server Error in github.com/free5gc/udm
Modified: 3/23/2026
—Go
GO-2026-5138· CVE-2026-42459, GHSA-585v-hcgf-jhfrFree5GC UDM has Improper Input Validation and Generation of Error Messages Containing Sensitive Information in github.com/free5gc/udm
Modified: 6/25/2026