CVE-2026-40249— free5gc UDR fail-open request handling in PolicyDataSubsToNotifySubsIdPut may allow unintended subscription updates after input errors

free5gc UDR fail-open request handling in PolicyDataSubsToNotifySubsIdPut may allow unintended subscription updates after input errors

free5GC is an open-source implementation of the 5G core network. In versions 4.2.1 and below of the UDR service, the PUT handler for updating Policy Data notification subscriptions at /nudr-dr/v2/policy-data/subs-to-notify/{subsId} does not return after request body retrieval or deserialization errors. Although HTTP 500 or 400 error responses are sent, execution continues and the processor is invoked with a potentially uninitialized or partially initialized PolicyDataSubscription object. This fail-open behavior may allow unintended modification of existing Policy Data notification subscriptions with invalid or empty input, depending on downstream processor and storage behavior. A patched version was not available at the time of publication.

N/A

对因果或异常条件的不恰当检查

free5GC 安全漏洞

free5GC是free5GC开源的一个第 5 代 (5G) 移动核心网络的开源项目。 free5GC 4.2.1及之前版本存在安全漏洞，该漏洞源于UDR服务中PUT请求处理程序在请求体检索或反序列化错误后未正确返回，导致继续执行并使用可能未初始化或部分初始化的对象调用处理器，可能允许使用无效或空输入意外修改现有策略数据通知订阅。

N/A

N/A