CVE-2026-40249
free5GC is an open-source implementation of the 5G core network. In versions 4.2.1 and below of the UDR service, the PUT handler for updating Policy Data notification subscriptions at /nudr-dr/v2/policy-data/subs-to-notify/{subsId} does not return after request body retrieval or deserialization errors. Although HTTP 500 or 400 error responses are sent, execution continues and the processor is invoked with a potentially uninitialized or partially initialized PolicyDataSubscription object. This fail-open behavior may allow unintended modification of existing Policy Data notification subscriptions with invalid or empty input, depending on downstream processor and storage behavior. A patched version was not available at the time of publication.
Scoring
- Severity
- MEDIUM
- CVSS base score
- 6.9
- CVSS vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
- EPSS probability
- 0.32%
- CWE
- CWE-754, CWE-636
- Published
- 2026-04-16
- Last modified
- 2026-04-18
Affected products
- free5gc free5gc
Weakness type
Related vulnerabilities
- CVE-2026-87012 — Open WebUI: Any authenticated user can suppress calendar alerts instance-wide via a non-numeric alert value
- CVE-2026-87656 — Improper state validation in Safebrowsing in Google Chrome prior to 153.0.8010.36 allowed a remote...
- CVE-2026-87532 — Improper state validation in Safebrowsing in Google Chrome prior to 153.0.8010.36 allowed a remote...
- CVE-2026-87548 — Improper state validation in Installer in Google Chrome prior to 153.0.8010.36 allowed a remote...
- CVE-2026-87645 — Improper state validation in Safebrowsing in Google Chrome prior to 153.0.8010.36 allowed a remote...
- CVE-2026-73314 — XenForo < 2.3.13 Signature Verification Bypass via PayPal REST Webhook
- CVE-2026-85014 — undici vulnerable to Denial of Service via WebSocketStream unclean close
- CVE-2026-55484 — ALOS HTTP: Unauthenticated remote DoS: malformed path starting with "?" triggers out-of-bounds panic in sanitizeRequestPath, crashing entire server