# github.com/free5gc/udm (Go) vulnerabilities 7 known vulnerabilities (4 high, 2 medium), with the versions each affects and the releases that fix them. ## At a glance - Latest release: v1.4.6 (Aug 28, 2026): affected by 2 advisories - Newest unaffected release: Every release is affected by at least one advisory - Releases: 19 since v1.0.0 (Jan 30, 2021) - Registry: https://pkg.go.dev/github.com/free5gc/udm - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2026-42459: v1.0.0 to v1.4.6 (through the newest release) - CVE-2026-33192: v1.0.0 to v1.4.1 (v1.4.2 is outside it) - CVE-2026-33065: v1.0.0 to v1.4.1 (v1.4.2 is outside it) - CVE-2026-33064: v1.0.0 to v1.4.1 (v1.4.2 is outside it) - CVE-2026-33191: v1.0.0 to v1.4.1 (v1.4.2 is outside it) - CVE-2025-60633: v1.0.0 to v1.4.6 (through the newest release) - CVE-2023-46324: v1.0.0 to v1.1.1 (v1.2.1 is outside it) ## Advisories (7) ### [CVE-2026-42459](https://cve.now/CVE-2026-42459): free5GC: Improper Input Validation and Generation of Error Message Containing Sensitive Information in github.com/free5gc/udm - Severity: High 7.7 - Published: May 27, 2026 - Affected: through 1.4.3; all versions. - No fix released. The latest release, v1.4.6, is still affected. ### [CVE-2026-33192](https://cve.now/CVE-2026-33192): free5GC UDM incorrectly returns 500 for empty supi path parameter in PATCH sdm-subscriptions reques - Severity: High 8.7 - Published: Mar 20, 2026 - Affected: fixed in 1.4.2. - Fixed in v1.4.2 (released Mar 2, 2026, 18 days before disclosure). - The latest release, v1.4.6, is not affected. ### [CVE-2026-33065](https://cve.now/CVE-2026-33065): free5GC UDM incorrectly returns 500 for empty supi path parameter in DELETE sdm-subscriptions request - Severity: Medium 6.9 - Published: Mar 20, 2026 - Affected: fixed in 1.4.2. - Fixed in v1.4.2 (released Mar 2, 2026, 18 days before disclosure). - The latest release, v1.4.6, is not affected. ### [CVE-2026-33064](https://cve.now/CVE-2026-33064): free5GC UDM DataChangeNotification Procedure Panic Due to Nil Pointer Dereference - Severity: High 8.7 - Published: Mar 20, 2026 - Affected: fixed in 1.4.2. - Fixed in v1.4.2 (released Mar 2, 2026, 18 days before disclosure). - The latest release, v1.4.6, is not affected. ### [CVE-2026-33191](https://cve.now/CVE-2026-33191): free5GC UDM vulnerable to null byte injection in URL path parameters causing 500 Internal Server Error - Severity: High 8.7 - Published: Mar 20, 2026 - Affected: fixed in 1.4.2. - Fixed in v1.4.2 (released Mar 2, 2026, 18 days before disclosure). - The latest release, v1.4.6, is not affected. ### [CVE-2025-60633](https://cve.now/CVE-2025-60633): An issue was discovered in Free5GC v4.0.0 and v4.0.1 allowing an attacker to cause a denial of service via the… - Severity: Medium 6.5 - Published: Nov 24, 2025 - Affected: all versions; through 1.4.0. - No fix released. The latest release, v1.4.6, is still affected. ### [CVE-2023-46324](https://cve.now/CVE-2023-46324): pkg/suci/suci.go in free5GC udm before 1.2.0, when Go before 1.19 is used, allows an Invalid Curve Attack because it may compute a shared… - Severity: Unrated - Published: Oct 23, 2023 - Affected: fixed in 1.2.0. - Fixed in v1.2.1 (released Feb 7, 2024, 107 days after disclosure, the advisory names 1.2.0, which was never published). - The latest release, v1.4.6, is not affected. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/go/github.com/free5gc/udm Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.