Free5GC is an open-source Linux Foundation project for 5th generation (5G) mobile core networks. Versions prior to 1.4.2 are vulnerable to procedure panic caused by Nil Pointer Dereference in the /sdm-subscriptions endpoint. A remote attacker can cause the UDM service to panic and crash by sending a crafted POST request to the /sdm-subscriptions endpoint with a malformed URL path containing path traversal sequences (../) and a large JSON payload. The DataChangeNotificationProcedure function in notifier.go attempts to access a nil pointer without proper validation, causing a complete service crash with "runtime error: invalid memory address or nil pointer dereference". Exploitation would result in UDM functionality disruption until recovery by restart. This issue has been fixed in version 1.4.2.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Free5GC is an open-source Linux Foundation project for 5th generation (5G) mobile core networks. Versions     prior to 1.4.2 are vulnerable to procedure panic caused by Nil Pointer Dereference in the /sdm-     subscriptions endpoint. A remote attacker can cause the UDM service to panic and crash by sending a     crafted POST request to the /sdm-subscriptions endpoint with a malformed URL path containing path     traversal sequences (../) and a large JSON payload. The DataChangeNotificationProcedure function in     notifier.go attempts to access a nil pointer without proper validation, causing a complete service crash     with runtime error: invalid memory address or nil pointer dereference. Exploitation would result in UDM     functionality disruption until recovery by restart. This issue has been fixed in version 1.4.2.
    (CVE-2026-33064)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Free5GC is an open-source Linux Foundation project for 5th generation (5G) mobile core networks. Versions
    prior to 1.4.2 are vulnerable to procedure panic caused by Nil Pointer Dereference in the /sdm-
    subscriptions endpoint. A remote attacker can cause the UDM service to panic and crash by sending a
    crafted POST request to the /sdm-subscriptions endpoint with a malformed URL path containing path
    traversal sequences (../) and a large JSON payload. The DataChangeNotificationProcedure function in
    notifier.go attempts to access a nil pointer without proper validation, causing a complete service crash
    with "runtime error: invalid memory address or nil pointer dereference". Exploitation would result in UDM
    functionality disruption until recovery by restart. This issue has been fixed in version 1.4.2.
    (CVE-2026-33064)

ID	Name	Product	Family	Severity
303461	Linux Distros Unpatched Vulnerability : CVE-2026-33064	Nessus	Misc.	high
438975	SCA: security update for github.com/free5gc/udm (GHSA-7g27-v5wj-jr75)	Tenable Cloud Security	SCA Checks	high
438975	SCA: security update for github.com/free5gc/udm (GHSA-7g27-v5wj-jr75)	Tenable Self-Hosted Container Security	SCA Checks	high

Detections

Analytics

CVE-2026-33064

high

Tenable Plugins

high

high

high