GoPackage

github.com/free5gc/udm

7 known vulnerabilities (4 high, 2 medium), with the versions each affects and the releases that fix them.

Latest release: v1.4.6 (Aug 28, 2026): affected by 2 advisories
Newest unaffected release: Every release is affected by at least one advisory
Advisories: 7 · 4 high, 2 medium

Releases: 19 since v1.0.0 (Jan 30, 2021)
Registry: pkg.go.dev
Releases read: Nov 8, 2026

Version timeline

CVE-2026-42459
Affects v1.0.0 to v1.4.6 (through the newest release)
CVE-2026-33192
Affects v1.0.0 to v1.4.1 (v1.4.2 is outside it)
CVE-2026-33065
Affects v1.0.0 to v1.4.1 (v1.4.2 is outside it)
CVE-2026-33064
Affects v1.0.0 to v1.4.1 (v1.4.2 is outside it)
CVE-2026-33191
Affects v1.0.0 to v1.4.1 (v1.4.2 is outside it)
CVE-2025-60633
Affects v1.0.0 to v1.4.6 (through the newest release)
CVE-2023-46324
Affects v1.0.0 to v1.1.1 (v1.2.1 is outside it)

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 7

CVE-2026-42459High 7.7
free5GC: Improper Input Validation and Generation of Error Message Containing Sensitive Information in github.com/free5gc/udm
Affected: through 1.4.3; all versions.
No fix released. The latest release, v1.4.6, is still affected.
CVE-2026-33192High 8.7
free5GC UDM incorrectly returns 500 for empty supi path parameter in PATCH sdm-subscriptions reques
Affected: fixed in 1.4.2.
Fixed in v1.4.2 (released Mar 2, 2026, 18 days before disclosure).
The latest release, v1.4.6, is not affected.
CVE-2026-33065Medium 6.9
free5GC UDM incorrectly returns 500 for empty supi path parameter in DELETE sdm-subscriptions request
Affected: fixed in 1.4.2.
Fixed in v1.4.2 (released Mar 2, 2026, 18 days before disclosure).
The latest release, v1.4.6, is not affected.
CVE-2026-33064High 8.7
free5GC UDM DataChangeNotification Procedure Panic Due to Nil Pointer Dereference
Affected: fixed in 1.4.2.
Fixed in v1.4.2 (released Mar 2, 2026, 18 days before disclosure).
The latest release, v1.4.6, is not affected.
CVE-2026-33191High 8.7
free5GC UDM vulnerable to null byte injection in URL path parameters causing 500 Internal Server Error
Affected: fixed in 1.4.2.
Fixed in v1.4.2 (released Mar 2, 2026, 18 days before disclosure).
The latest release, v1.4.6, is not affected.
CVE-2025-60633Medium 6.5
An issue was discovered in Free5GC v4.0.0 and v4.0.1 allowing an attacker to cause a denial of service via the…
Affected: all versions; through 1.4.0.
No fix released. The latest release, v1.4.6, is still affected.
CVE-2023-46324Unrated
pkg/suci/suci.go in free5GC udm before 1.2.0, when Go before 1.19 is used, allows an Invalid Curve Attack because it may compute a shared…
Affected: fixed in 1.2.0.
Fixed in v1.2.1 (released Feb 7, 2024, 107 days after disclosure, the advisory names 1.2.0, which was never published).
The latest release, v1.4.6, is not affected.