CVE-2026-33191

Free5GC is an open-source Linux Foundation project for 5th generation (5G) mobile core networks. Versions prior to 1.4.2 are vulnerable to null byte injection in URL path parameters. A remote attacker can inject null bytes (URL-encoded as %00) into the supi path parameter of the UDM's Nudm_SubscriberDataManagement API. This causes URL parsing failure in Go's net/url package with the error "invalid control character in URL", resulting in a 500 Internal Server Error. This null byte injection vulnerability can be exploited for denial of service attacks. When the supi parameter contains null characters, the UDM attempts to construct a URL for UDR that includes these control characters. Go's URL parser rejects them, causing the request to fail with 500 instead of properly validating input and returning 400 Bad Request. This issue has been fixed in version 1.4.2.

• CWE-158
• CWE-248

• https://github.com/free5gc/free5gc/security/advisories/GHSA-p9hg-pq3q-v9gvPatch, Vendor Advisory
• https://github.com/free5gc/udm/commit/88de9fa74a1b3f3522e53b4cfa2d184712ffa4eePatch

Published

Mar 20, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-33186gRPC-Go is the Go language implementation of gRPC. Versions …9.1
• CVE-2026-33187Rejected reason: Further research determined the issue origi…
• CVE-2026-33188Rejected reason: Further research determined the issue origi…
• CVE-2026-33189Rejected reason: Further research determined the issue origi…
• CVE-2026-3319Reflected Cross-Site Scripting (XSS) in the latest demo vers…5.1
• CVE-2026-33190CoreDNS is a DNS server that chains plugins. In versions pri…7.5
• CVE-2026-33192Free5GC is an open-source Linux Foundation project for 5th g…5.3
• CVE-2026-33193Docmost is open-source collaborative wiki and documentation …4.6
• CVE-2026-33194SiYuan is a personal knowledge management system. Prior to v…6.8
• CVE-2026-33195Active Storage allows users to attach cloud and local files …9.8
• CVE-2026-3320Reflected Cross-Site Scripting (XSS) in the latest demo vers…5.1
• CVE-2026-33201Digital Photo Frame GH-WDF10A provided by GREEN HOUSE CO., L…7