CVE-2026-33191

CVE-2026-33191 is a null byte injection vulnerability affecting Free5GC versions prior to 1.4.2, specifically within the UDM's Nudm_SubscriberDataManagement API. A remote attacker can inject URL-encoded null bytes (%00) into the `supi` path parameter, causing Go's URL parser to fail and resulting in a 500 Internal Server Error. Rated 8.6 HIGH on the CVSS scale, this vulnerability has a network attack vector and low attack complexity, allowing unauthenticated remote attackers to trigger a denial of service (DoS) condition. The issue stems from improper input validation, leading to a server error instead of a bad request response. There is currently no public exploit code available, nor is it listed on the CISA KEV catalog or Hot List, with its EPSS score indicating a very low probability of active exploitation.