{"id":"EUVD-2026-32574","enisaUuid":"e8f0e3e4-61e5-3be1-81d3-68c869063501","description":"free5GC is an open-source implementation of the 5G core network. Prior to 4.2.2, free5GC\u0027s UDR nudr-dr DELETE /subscription-data/{ueId}/{servingPlmnId}/ee-subscriptions/{subsId}/amf-subscriptions handler panics on a single authenticated request against a fresh UDR instance when the supplied ueId does not exist in UESubsCollection. The processor checks value, ok :\u003d udrSelf.UESubsCollection.Load(ueId) and sets a 404 USER_NOT_FOUND problem-details on the miss path, but execution continues and immediately runs value.(*udr_context.UESubsData) -- a Go type assertion on a nil interface, which panics with interface conversion: interface {} is nil, not *context.UESubsData. Gin recovery converts the panic into HTTP 500, but the endpoint remains repeatedly panicable. This vulnerability is fixed in 4.2.2.","datePublished":"May 27, 2026, 3:44:27 PM","dateUpdated":"May 28, 2026, 2:38:09 PM","baseScore":6.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","references":"https://github.com/free5gc/free5gc/security/advisories/GHSA-jqfc-gwj5-3w63\nhttps://github.com/free5gc/free5gc/issues/920\nhttps://github.com/free5gc/udr/pull/60\nhttps://github.com/free5gc/udr/commit/8a1d3c63be99d378806d771f086ff32f1867da99\n","aliases":"CVE-2026-44324\nGHSA-jqfc-gwj5-3w63\n","assigner":"GitHub_M","epss":0.42,"enisaIdProduct":[{"id":"fab0d749-bab9-3818-ade1-589106b4741a","product":{"name":"Free5GC","vendor":{"name":"Free5Gc"}},"product_version":"\u003c 4.2.2"}],"enisaIdVendor":[{"id":"a1437d98-96a2-3010-b21f-0ab0f25f4489","vendor":{"name":"Free5Gc"}}],"enisaIdVulnerability":[{"id":"191d07ab-3f8b-3223-81d3-86652e79c63f","vulnerability":{"id":"CVE-2026-44324","description":"free5GC is an open-source implementation of the 5G core network. Prior to 4.2.2, free5GC\u0027s UDR nudr-dr DELETE /subscription-data/{ueId}/{servingPlmnId}/ee-subscriptions/{subsId}/amf-subscriptions handler panics on a single authenticated request against a fresh UDR instance when the supplied ueId does not exist in UESubsCollection. The processor checks value, ok :\u003d udrSelf.UESubsCollection.Load(ueId) and sets a 404 USER_NOT_FOUND problem-details on the miss path, but execution continues and immediately runs value.(*udr_context.UESubsData) -- a Go type assertion on a nil interface, which panics with interface conversion: interface {} is nil, not *context.UESubsData. Gin recovery converts the panic into HTTP 500, but the endpoint remains repeatedly panicable. This vulnerability is fixed in 4.2.2.","datePublished":"May 27, 2026, 3:44:27 PM","dateUpdated":"May 28, 2026, 2:38:09 PM","status":"PUBLISHED","baseScore":6.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","references":"https://github.com/free5gc/free5gc/security/advisories/GHSA-jqfc-gwj5-3w63\nhttps://github.com/free5gc/free5gc/issues/920\nhttps://github.com/free5gc/udr/pull/60\nhttps://github.com/free5gc/udr/commit/8a1d3c63be99d378806d771f086ff32f1867da99\n","enisa_id":"EUVD-2026-32574\n","assigner":"GitHub_M","epss":0.42,"dataProcessed":"Nov 1, 2026, 7:18:36 AM","vulnerabilityProduct":[{"id":"c0bfe440-62fd-354f-83bb-fe41bd701881","product":{"name":"Free5GC","vendor":{"name":"Free5Gc"}},"product_version":"\u003c 4.2.2"}],"vulnerabilityVendor":[{"id":"fa68c682-3241-31a9-9903-833a57ce444a","vendor":{"name":"Free5Gc"}}]}},{"id":"2855fad6-54f9-3559-813e-e9a1fecfc27a","vulnerability":{"id":"GHSA-jqfc-gwj5-3w63","description":"free5GC\u0027s UDR nudr-dr DELETE amf-subscriptions panics on missing UE state via nil interface type assertion (single authenticated request)","datePublished":"May 8, 2026, 10:52:20 PM","dateUpdated":"Jun 8, 2026, 11:48:08 PM","baseScore":0.0,"references":"https://github.com/free5gc/free5gc/security/advisories/GHSA-jqfc-gwj5-3w63\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-44324\nhttps://github.com/free5gc/free5gc/issues/920\nhttps://github.com/free5gc/udr/pull/60\nhttps://github.com/free5gc/udr/commit/8a1d3c63be99d378806d771f086ff32f1867da99\nhttps://github.com/free5gc/free5gc\n","enisa_id":"EUVD-2026-32574\n","aliases":"GHSA-jqfc-gwj5-3w63\nCVE-2026-44324\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:00:21 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}