CVE-2026-33191
Free5Gc Udm ≤ 1.4.2
Raw vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XSummary
CVE-2026-33191 is a high-severity Improper Neutralization of Null Byte or NUL Character (CWE-158) vulnerability in Free5Gc Udm. Its CVSS base score is 8.7 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Endpoint Denial of Service (T1499); ranked at the 28th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SI-10 (Information Input Validation) and SA-8 (Security and Privacy Engineering Principles) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2026-33191 is a null byte injection vulnerability affecting Free5GC, an open-source Linux Foundation project implementing 5th generation (5G) mobile core networks. Versions prior to 1.4.2 are vulnerable, specifically in the UDM (Unified Data Management) component's Nudm_SubscriberDataManagement API. The issue arises when a null byte (URL-encoded as %00) is injected into the supi path parameter, leading to a URL parsing failure in Go's net/url package. This triggers an "invalid control character in URL" error, resulting in a 500 Internal Server Error instead of proper input validation and a 400 Bad Request response. The vulnerability is associated with CWEs-158 (Input Improperly Controlled: Name or Reference) and CWE-248 (Uncaught Exception), and carries a CVSS v3.1 base score of 8.6 (AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H).
A remote attacker with network access can exploit this vulnerability without authentication or user interaction by sending crafted requests to the affected API endpoint with a %00-encoded null byte in the supi parameter. When the UDM processes the parameter and constructs a URL for the UDR (Unified Data Repository), the embedded null character causes Go's URL parser to reject it, denying service to legitimate requests. This enables denial-of-service attacks, potentially disrupting 5G core network functions by repeatedly triggering 500 errors and overwhelming the service.
The Free5GC security advisory (GHSA-p9hg-pq3q-v9gv) and the fixing commit (88de9fa74a1b3f3522e53b4cfa2d184712ffa4ee) in the UDM repository confirm the issue was resolved in version 1.4.2 through improved input validation to prevent null byte propagation and ensure proper error handling with 400 responses. Security practitioners should upgrade to Free5GC 1.4.2 or later and review API inputs for control characters in path parameters.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-13633
Vulnerability Data
Free5GC is an open-source Linux Foundation project for 5th generation (5G) mobile core networks. Versions prior to 1.4.2 are vulnerable to null byte injection in URL path parameters. A remote attacker can inject null bytes (URL-encoded as %00) into the…
more
supi path parameter of the UDM's Nudm_SubscriberDataManagement API. This causes URL parsing failure in Go's net/url package with the error "invalid control character in URL", resulting in a 500 Internal Server Error. This null byte injection vulnerability can be exploited for denial of service attacks. When the supi parameter contains null characters, the UDM attempts to construct a URL for UDR that includes these control characters. Go's URL parser rejects them, causing the request to fail with 500 instead of properly validating input and returning 400 Bad Request. This issue has been fixed in version 1.4.2.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V1.2.10
Mitigating Controls (NIST 800-53 r5) AI
Input validation directly requires neutralizing or rejecting malformed characters such as NUL before they reach downstream components.
Security engineering principles include robust exception management to keep the system in a defined state.
Fail-in-known-state reduces the impact when an uncaught exception occurs by preserving a safe condition.
Error handling requirements force structured catching and response to exceptions instead of allowing them to propagate uncaught.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly require input neutralization and validation to prevent null-byte flaws.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing can detect null-byte flaws but does not itself implement the neutralization.
Secure development lifecycle mandates input validation and sanitization that directly prevents null-byte injection.
Application security requirements include explicit rules for neutralizing dangerous characters such as NUL.
Secure architecture principles reduce the likelihood of unsafe data flows but do not prescribe character neutralization.
Secure coding standards explicitly require proper neutralization of null bytes and other metacharacters.