Free5GC is an open-source Linux Foundation project for 5th generation (5G) mobile core networks. In versions prior to 1.4.2, the UDM incorrectly converts a downstream 400 Bad Request (from UDR) into a 500 Internal Server Error when handling PATCH requests with an empty supi path parameter. Additionally, the UDM incorrectly translates the PATCH method to PUT when forwarding to UDR, indicating a deeper architectural issue. This leaks internal error handling behavior, making it difficult for clients to distinguish between client-side errors and server-side failures. The issue has been patched in version 1.4.2.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Free5GC is an open-source Linux Foundation project for 5th generation (5G) mobile core networks. In     versions prior to 1.4.2, the UDM incorrectly converts a downstream 400 Bad Request (from UDR) into a 500     Internal Server Error when handling PATCH requests with an empty supi path parameter. Additionally, the     UDM incorrectly translates the PATCH method to PUT when forwarding to UDR, indicating a deeper     architectural issue. This leaks internal error handling behavior, making it difficult for clients to     distinguish between client-side errors and server-side failures. The issue has been patched in version     1.4.2. (CVE-2026-33192)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Free5GC is an open-source Linux Foundation project for 5th generation (5G) mobile core networks. In
    versions prior to 1.4.2, the UDM incorrectly converts a downstream 400 Bad Request (from UDR) into a 500
    Internal Server Error when handling PATCH requests with an empty supi path parameter. Additionally, the
    UDM incorrectly translates the PATCH method to PUT when forwarding to UDR, indicating a deeper
    architectural issue. This leaks internal error handling behavior, making it difficult for clients to
    distinguish between client-side errors and server-side failures. The issue has been patched in version
    1.4.2. (CVE-2026-33192)

ID	Name	Product	Family	Severity
303459	Linux Distros Unpatched Vulnerability : CVE-2026-33192	Nessus	Misc.	high
438990	SCA: security update for github.com/free5gc/udm (GHSA-5rvc-5cwx-g5x8)	Tenable Cloud Security	SCA Checks	high
438990	SCA: security update for github.com/free5gc/udm (GHSA-5rvc-5cwx-g5x8)	Tenable Self-Hosted Container Security	SCA Checks	high

Detections

Analytics

CVE-2026-33192

high

Tenable Plugins

high

high

high