CVE-2026-33191
Published: 20 March 2026
Description
Free5GC is an open-source Linux Foundation project for 5th generation (5G) mobile core networks. Versions prior to 1.4.2 are vulnerable to null byte injection in URL path parameters. A remote attacker can inject null bytes (URL-encoded as %00) into the…
more
supi path parameter of the UDM's Nudm_SubscriberDataManagement API. This causes URL parsing failure in Go's net/url package with the error "invalid control character in URL", resulting in a 500 Internal Server Error. This null byte injection vulnerability can be exploited for denial of service attacks. When the supi parameter contains null characters, the UDM attempts to construct a URL for UDR that includes these control characters. Go's URL parser rejects them, causing the request to fail with 500 instead of properly validating input and returning 400 Bad Request. This issue has been fixed in version 1.4.2.
Mitigating Controls (NIST 800-53 r5)AI
Mandates validation of path parameters like supi to reject null bytes (%00), preventing URL parsing failures and DoS crashes.
Requires proper error handling to return 400 Bad Request instead of exploitable 500 Internal Server Errors from invalid control characters.
Provides denial-of-service protection mechanisms to limit the impact of repeated null byte injections overwhelming the UDM API.
Security SummaryAI
CVE-2026-33191 is a null byte injection vulnerability affecting Free5GC, an open-source Linux Foundation project implementing 5th generation (5G) mobile core networks. Versions prior to 1.4.2 are vulnerable, specifically in the UDM (Unified Data Management) component's Nudm_SubscriberDataManagement API. The issue arises when a null byte (URL-encoded as %00) is injected into the supi path parameter, leading to a URL parsing failure in Go's net/url package. This triggers an "invalid control character in URL" error, resulting in a 500 Internal Server Error instead of proper input validation and a 400 Bad Request response. The vulnerability is associated with CWEs-158 (Input Improperly Controlled: Name or Reference) and CWE-248 (Uncaught Exception), and carries a CVSS v3.1 base score of 8.6 (AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H).
A remote attacker with network access can exploit this vulnerability without authentication or user interaction by sending crafted requests to the affected API endpoint with a %00-encoded null byte in the supi parameter. When the UDM processes the parameter and constructs a URL for the UDR (Unified Data Repository), the embedded null character causes Go's URL parser to reject it, denying service to legitimate requests. This enables denial-of-service attacks, potentially disrupting 5G core network functions by repeatedly triggering 500 errors and overwhelming the service.
The Free5GC security advisory (GHSA-p9hg-pq3q-v9gv) and the fixing commit (88de9fa74a1b3f3522e53b4cfa2d184712ffa4ee) in the UDM repository confirm the issue was resolved in version 1.4.2 through improved input validation to prevent null byte propagation and ensure proper error handling with 400 responses. Security practitioners should upgrade to Free5GC 1.4.2 or later and review API inputs for control characters in path parameters.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability allows remote unauthenticated exploitation of a public-facing API (T1190) to trigger application crashes via null byte injection, enabling endpoint DoS through application exploitation (T1499.004).