Skip to main content
cve.nowby Sazabi
← Go
GoPackage

github.com/free5gc/udr

9 known vulnerabilities (4 high, 5 medium), with the versions each affects and the releases that fix them.

Latest release
v1.4.5 (Aug 19, 2026): affected by 7 advisories
Newest unaffected release
Every release is affected by at least one advisory
Advisories
9 · 4 high, 5 medium
Releases
17 since v1.0.0 (Jan 30, 2021)
Registry
pkg.go.dev
Releases read
Nov 8, 2026

Version timeline

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 9

  • CVE-2026-47780Medium 6.9

    free5GC: UDR Improper ueId validation in free5GC EE subscription handlers allows arbitrary identifier persistence

    Affected: through 1.4.3; all versions.

    No fix released. The latest release, v1.4.5, is still affected.

  • CVE-2026-44323Medium 4.3

    free5GC: UDR nudr-dr DELETE amf-subscriptions panics on missing subsId when UE state exists (nil pointer dereference)

    Affected: fixed in 1.4.3.

    Fixed in v1.4.3 (released Apr 7, 2026, 50 days before disclosure).

    The latest release, v1.4.5, is not affected.

  • CVE-2026-44324Medium 6.5

    free5GC: UDR nudr-dr DELETE amf-subscriptions panics on missing UE state via nil interface type assertion (single authenticated request)

    Affected: fixed in 1.4.3.

    Fixed in v1.4.3 (released Apr 7, 2026, 50 days before disclosure).

    The latest release, v1.4.5, is not affected.

  • CVE-2026-40343Medium 6.9

    free5GC UDR: Fail-open handling in PolicyDataSubsToNotifyPost allows unintended subscription creation

    Affected: through 1.4.2; all versions.

    No fix released. The latest release, v1.4.5, is still affected.

  • CVE-2026-40249Medium 6.9

    free5gc UDR fail-open request handling in PolicyDataSubsToNotifySubsIdPut may allow unintended subscription updates after input errors

    Affected: all versions; through 1.4.2.

    No fix released. The latest release, v1.4.5, is still affected.

  • free5gc UDR improper path validation allows unauthenticated creation and modification of Traffic Influence Subscriptions

    Affected: all versions; through 1.4.2.

    No fix released. The latest release, v1.4.5, is still affected.

  • free5gc UDR improper path validation allows unauthenticated access to Traffic Influence Subscriptions

    Affected: all versions; through 1.4.2.

    No fix released. The latest release, v1.4.5, is still affected.

  • free5gc UDR improper path validation allows unauthenticated deletion of Traffic Influence Subscriptions

    Affected: all versions; through 1.4.2.

    No fix released. The latest release, v1.4.5, is still affected.

  • Free5GC: UDR nudr-dr influenceData/subs-to-notify leaks SUPI in error response body without authentication

    Affected: all versions; through 1.4.2.

    No fix released. The latest release, v1.4.5, is still affected.