CVE-2026-33192 — Vulnetix

CVE-2026-33192 PUBLISHED CVSS 8.699999809265137 HIGH

Free5GC is an open-source Linux Foundation project for 5th generation (5G) mobile core networks. In versions prior to 1.4.2, the UDM incorrectly converts a downstream 400 Bad Request (from UDR) into a 500 Internal Server Error when handling PATCH requests with an empty supi path parameter. Additionally, the UDM incorrectly translates the PATCH method to PUT when forwarding to UDR, indicating a deeper architectural issue. This leaks internal error handling behavior, making it difficult for clients to distinguish between client-side errors and server-side failures. The issue has been patched in version 1.4.2.

EPSS 0.02% · 3.2th percentile

Risk Scores

CVSS 4.0

8.699999809265137

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

EPSS Score

0.02%

3.2th percentile

Affected Products

Vendor	Product	Versions
free5gc	free5gc	,
github.com	free5gc/udm	0, 0
free5gc	udm	0, 0

Exploit Intelligence

https://github.com/free5gc/free5gc/issues/784 (nist-nvd)
CIRCL seen: CVE-2026-33192 (circl-sighting)
https://github.com/free5gc/free5gc/security/advisories/GHSA-5rvc-5cwx-g5x8 (circl)
https://github.com/free5gc/udm/pull/79 (circl)

Timeline

Mar 18, 2026 CVE Published
Mar 19, 2026 Security Advisory
Mar 20, 2026 CVE Updated
Mar 20, 2026 EPSS Score
Mar 20, 2026 PoC Published
Mar 21, 2026 EPSS Score
Mar 22, 2026 EPSS Score
Mar 23, 2026 EPSS Score
Mar 24, 2026 EPSS Score
Mar 25, 2026 EPSS Score
May 18, 2026 EPSS Score
May 19, 2026 EPSS Score

References

Open in Interactive Console →