Free5GC is an open-source Linux Foundation project for 5th generation (5G) mobile core networks. Versions prior to 1.4.2 are vulnerable to null byte injection in URL path parameters. A remote attacker can inject null bytes (URL-encoded as %00) into the supi path parameter of the UDM's Nudm_SubscriberDataManagement API. This causes URL parsing failure in Go's net/url package with the error "invalid control character in URL", resulting in a 500 Internal Server Error. This null byte injection vulnerability can be exploited for denial of service attacks. When the supi parameter contains null characters, the UDM attempts to construct a URL for UDR that includes these control characters. Go's URL parser rejects them, causing the request to fail with 500 instead of properly validating input and returning 400 Bad Request. This issue has been fixed in version 1.4.2.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Free5GC is an open-source Linux Foundation project for 5th generation (5G) mobile core networks. Versions     prior to 1.4.2 are vulnerable to null byte injection in URL path parameters. A remote attacker can inject     null bytes (URL-encoded as %00) into the supi path parameter of the UDM's Nudm_SubscriberDataManagement     API. This causes URL parsing failure in Go's net/url package with the error invalid control character in     URL, resulting in a 500 Internal Server Error. This null byte injection vulnerability can be exploited     for denial of service attacks. When the supi parameter contains null characters, the UDM attempts to     construct a URL for UDR that includes these control characters. Go's URL parser rejects them, causing the     request to fail with 500 instead of properly validating input and returning 400 Bad Request. This issue     has been fixed in version 1.4.2. (CVE-2026-33191)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Free5GC is an open-source Linux Foundation project for 5th generation (5G) mobile core networks. Versions
    prior to 1.4.2 are vulnerable to null byte injection in URL path parameters. A remote attacker can inject
    null bytes (URL-encoded as %00) into the supi path parameter of the UDM's Nudm_SubscriberDataManagement
    API. This causes URL parsing failure in Go's net/url package with the error "invalid control character in
    URL", resulting in a 500 Internal Server Error. This null byte injection vulnerability can be exploited
    for denial of service attacks. When the supi parameter contains null characters, the UDM attempts to
    construct a URL for UDR that includes these control characters. Go's URL parser rejects them, causing the
    request to fail with 500 instead of properly validating input and returning 400 Bad Request. This issue
    has been fixed in version 1.4.2. (CVE-2026-33191)

ID	Name	Product	Family	Severity
303463	Linux Distros Unpatched Vulnerability : CVE-2026-33191	Nessus	Misc.	high
438970	SCA: security update for github.com/free5gc/udm (GHSA-p9hg-pq3q-v9gv)	Tenable Cloud Security	SCA Checks	high
438970	SCA: security update for github.com/free5gc/udm (GHSA-p9hg-pq3q-v9gv)	Tenable Self-Hosted Container Security	SCA Checks	high

Detections

Analytics

CVE-2026-33191

high

Tenable Plugins

high

high

high