CVE-2026-40343

OVERVIEW CVE-2026-40343 is a fail-open request handling vulnerability in free5GC UDR (User Data Repository) versions up to and including 1.4.2, an open-source 5G mobile core network component. The flaw exists in the policy-data subscription endpoint where the service continues processing requests despite errors during request body retrieval or deserialization, potentially creating invalid or partially processed Policy Data notification subscriptions. SEVERITY The vulnerability appears to have a low attack complexity with network accessibility, though formal CVSS metrics are not yet assigned. The flaw's impact depends on downstream processor behavior, potentially allowing attackers to create malformed subscriptions that could disrupt notification mechanisms or introduce unexpected system states. The FAUCET Risk Score of 46/100 indicates moderate concern, and the EPSS score of 0.00038 suggests relatively low widespread exploitation likelihood. EXPLOITATION STATUS There is no evidence of active exploitation, with the vulnerability absent from the CISA Known Exploited Vulnerabilities catalog. No public exploit code has been reported. Community attention appears minimal, though as of publication no patched version is available, which may limit visibility and adoption of fixes once released. Organizations running affected free5GC versions should monitor for patches and consider implementing request validation controls.