{"id":"GHSA-jwch-w7wh-gqjm","revision":null,"records":[{"revision":"eca9a35e40da478f95091e40108502f5","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-40343","aliases":[],"title":"free5GC UDR: Fail-open handling in PolicyDataSubsToNotifyPost allows unintended subscription creation","description":"free5GC UDR is the user data repository (UDR) for free5GC, an an open-source project for 5th generation (5G) mobile core networks. In versions up to and including 1.4.2, a fail-open request handling flaw in the UDR service causes the `/nudr-dr/v2/policy-data/subs-to-notify` POST handler to continue processing requests even after request body retrieval or deserialization errors. This may allow unintended creation of Policy Data notification subscriptions with invalid, empty, or partially processed input, depending on downstream processor behavior. As of time of publication, a patched version is not available.","state":0,"publishedAt":"2026-04-21T23:47:33.125+00:00","modifiedAt":"2026-04-22T13:12:25.224+00:00","affected":[{"ecosystem":"Vendor product","name":"udr","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"free5gc\",\n                    \"product\": \"udr\",\n                    \"versions\": [\n                        {\n                            \"version\": \"<= 1.4.2\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N","score":6.9,"severity":"MEDIUM"}],"references":["https://github.com/free5gc/free5gc/security/advisories/GHSA-jwch-w7wh-gqjm"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-40343","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-40343","identifiers":["CVE-2026-40343"]},"retained":false,"historicalAffected":[]},{"revision":"31c9f8798e824d78928c328b4c3fb135","observedAt":"2026-11-01T06:16:33.78+00:00","statement":{"source":"euvd","id":"EUVD-2026-24555","aliases":["CVE-2026-40343","GHSA-jwch-w7wh-gqjm"],"title":"free5GC UDR is the user data repository (UDR) for free5GC, an an open-source project for 5th generation (5G) mobile core networks. In versions up to and including 1.4.2, a fail-open request handling flaw in the UDR service causes the `/nudr…","description":"free5GC UDR is the user data repository (UDR) for free5GC, an an open-source project for 5th generation (5G) mobile core networks. In versions up to and including 1.4.2, a fail-open request handling flaw in the UDR service causes the `/nudr-dr/v2/policy-data/subs-to-notify` POST handler to continue processing requests even after request body retrieval or deserialization errors. This may allow unintended creation of Policy Data notification subscriptions with invalid, empty, or partially processed input, depending on downstream processor behavior. As of time of publication, a patched version is not available.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N","score":6.9,"severity":null}],"references":["https://github.com/free5gc/free5gc/security/advisories/GHSA-jwch-w7wh-gqjm"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-24555","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Apr 21, 2026, 11:47:33 PM","dateUpdated":"Apr 22, 2026, 1:12:25 PM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-24555","identifiers":["EUVD-2026-24555","CVE-2026-40343","GHSA-jwch-w7wh-gqjm"]},"retained":false,"historicalAffected":[]},{"revision":"7ecf24fa73d44895b27eced0f7b6793f","observedAt":"2026-10-27T10:09:56.341+00:00","statement":{"source":"nvd","id":"CVE-2026-40343","aliases":[],"title":"free5GC UDR is the user data repository (UDR) for free5GC, an an open-source project for 5th generation (5G) mobile core networks. In versions up to and including 1.4.2, a fail-open request handling flaw in the UDR service causes the `/nudr…","description":"free5GC UDR is the user data repository (UDR) for free5GC, an an open-source project for 5th generation (5G) mobile core networks. In versions up to and including 1.4.2, a fail-open request handling flaw in the UDR service causes the `/nudr-dr/v2/policy-data/subs-to-notify` POST handler to continue processing requests even after request body retrieval or deserialization errors. This may allow unintended creation of Policy Data notification subscriptions with invalid, empty, or partially processed input, depending on downstream processor behavior. As of time of publication, a patched version is not available.","state":0,"publishedAt":"2026-04-22T00:16:27.67+00:00","modifiedAt":"2026-10-26T22:10:00.163+00:00","affected":[],"metrics":[{"system":"CVSS 4.0 · security-advisories@github.com · Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","score":6.9,"severity":"MEDIUM"},{"system":"CVSS 3.1 · nvd@nist.gov · Primary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N","score":5.8,"severity":"MEDIUM"}],"references":["https://github.com/free5gc/free5gc/security/advisories/GHSA-jwch-w7wh-gqjm"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-40343","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Analyzed","weaknesses":["CWE-754"],"productCriteria":["cpe:2.3:a:free5gc:free5gc:*:*:*:*:*:*:*:*","cpe:2.3:a:free5gc:udr:*:*:*:*:*:go:*:*"],"sourceDates":{"published":"2026-04-22T00:16:27.670","lastModified":"2026-10-26T22:10:00.163"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2026-40343","identifiers":["CVE-2026-40343"]},"retained":false,"historicalAffected":[]},{"revision":"e0226a14c1fe4f1abd81a789fa7ea9e0","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GHSA-jwch-w7wh-gqjm","aliases":["CVE-2026-40343","GO-2026-5482"],"title":"free5GC UDR: Fail-open handling in PolicyDataSubsToNotifyPost allows unintended subscription creation","description":"### Summary\nA fail-open request handling flaw in the UDR service causes the `/nudr-dr/v2/policy-data/subs-to-notify` POST handler to continue processing requests even after request body retrieval or deserialization errors.\n\nThis may allow unintended creation of Policy Data notification subscriptions with invalid, empty, or partially processed input, depending on downstream processor behavior.\n\n### Details\nThe endpoint `POST /nudr-dr/v2/policy-data/subs-to-notify` is intended to create a Policy Data notification subscription only after the HTTP request body has been successfully read and parsed into a valid `PolicyDataSubscription` object. [file:93]\n\nIn the free5GC UDR implementation, the function `HandlePolicyDataSubsToNotifyPost` in `NFs/udr/internal/sbi/api_datarepository.go` does not terminate execution after input-processing failures. [file:93]\n\nThe request flow is:\n\n1. The handler calls `c.GetRawData()` to read the HTTP request body. [file:93]\n2. If `GetRawData()` fails, the handler sends an HTTP 500 error response, but **does not return**. [file:93]\n3. The handler then calls `openapi.Deserialize(policyDataSubscription, reqBody, \"application/json\")`. [file:93]\n4. If deserialization fails, the handler sends an HTTP 400 error response, but again **does not return**. [file:93]\n5. Execution continues and the handler still invokes `s.Processor().PolicyDataSubsToNotifyPostProcedure(c,policyDataSubscription)`. [file:93]\n\nAs a result, the endpoint operates in a fail-open manner: request processing may continue after fatal input validation or body handling errors, instead of being safely aborted. [file:93]\n\nThis differs from safer handlers in the same file, which use a helper pattern that explicitly returns on body read or deserialization failure before calling the corresponding processor routine. [file:93]\n\n### Security Impact\nThis issue affects a write-capable API that creates Policy Data notification subscriptions. [file:93]  \nBecause execution continues after body read or parsing failure, the processor may receive an uninitialized, partially initialized, or otherwise unintended `PolicyDataSubscription` object. [file:93]\n\nThe exact runtime impact depends on downstream processor behavior and storage validation. [file:93]  \nAt minimum, this is a security-relevant robustness flaw that can lead to inconsistent request handling; under certain runtime conditions it may allow creation of invalid or unintended subscription state. [file:93]\n\n### Reproduction Status\nThe code path has been statically confirmed. [file:93]  A complete runtime proof of unintended subscription creation after `GetRawData()` or deserialization failure has not yet been established. [file:93]\n\n### Patch\nThe handler should immediately terminate after sending an error response for body read or deserialization failure. [file:93]\n\nA minimal fix is to add missing `return` statements in `HandlePolicyDataSubsToNotifyPost`:\n\n```go\nreqBody, err := c.GetRawData()\nif err != nil {\n    logger.DataRepoLog.Errorf(\"Get Request Body error: %+v\", err)\n    pd := openapi.ProblemDetailsSystemFailure(err.Error())\n    c.Set(sbi.IN_PB_DETAILS_CTX_STR, pd.Cause)\n    c.JSON(http.StatusInternalServerError, pd)\n    return\n}\n\nerr = openapi.Deserialize(&policyDataSubscription, reqBody, \"application/json\")\nif err != nil {\n    logger.DataRepoLog.Errorf(\"Deserialize Request Body error: %+v\", err)\n    pd := util.ProblemDetailsMalformedReqSyntax(err.Error())\n    c.Set(sbi.IN_PB_DETAILS_CTX_STR, pd.Cause)\n    c.JSON(http.StatusBadRequest, pd)\n    return\n}\n```\nAdditionally, the deserialization call should pass a pointer to the destination\nobject so that the parsed body is written into the intended structure. [file:93]\n\n###Details\nThe issue is compounded by the handler's deserialization call, which passes\n`policyDataSubscription` directly to `openapi.Deserialize(...)` instead of\npassing a pointer to the destination object. This inconsistent usage further\nincreases the risk that request processing continues with an empty, partially\ninitialized, or otherwise unintended subscription object. [file:93]","state":0,"publishedAt":"2026-04-21T19:05:18+00:00","modifiedAt":"2026-06-25T23:11:35.406272+00:00","affected":[{"ecosystem":"Go","name":"github.com/free5gc/udr","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"last_affected","version":"1.4.2"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N","score":null,"severity":null},{"system":"CVSS_V4","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"MODERATE"}],"references":["https://github.com/free5gc/free5gc/security/advisories/GHSA-jwch-w7wh-gqjm","https://nvd.nist.gov/vuln/detail/CVE-2026-40343","https://github.com/free5gc/free5gc"],"sourceUrl":"https://github.com/advisories/GHSA-jwch-w7wh-gqjm","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-jwch-w7wh-gqjm","identifiers":["GHSA-jwch-w7wh-gqjm","CVE-2026-40343","GO-2026-5482"]},"retained":false,"historicalAffected":[]},{"revision":"0bd996113c0f4b35af99ee64af8b446f","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GO-2026-5482","aliases":["CVE-2026-40343","GHSA-jwch-w7wh-gqjm"],"title":"free5GC UDR: Fail-open handling in PolicyDataSubsToNotifyPost allows unintended subscription creation in github.com/free5gc/udr","description":"free5GC UDR: Fail-open handling in PolicyDataSubsToNotifyPost allows unintended subscription creation in github.com/free5gc/udr","state":0,"publishedAt":"2026-06-25T22:34:31+00:00","modifiedAt":"2026-06-25T23:01:15.5670813+00:00","affected":[{"ecosystem":"Go","name":"github.com/free5gc/udr","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[],"references":["https://github.com/free5gc/free5gc/security/advisories/GHSA-jwch-w7wh-gqjm","https://nvd.nist.gov/vuln/detail/CVE-2026-40343"],"sourceUrl":"https://osv.dev/vulnerability/GO-2026-5482","license":"OSV · upstream source license applies","key":"osv:GO-2026-5482","identifiers":["GO-2026-5482","CVE-2026-40343","GHSA-jwch-w7wh-gqjm"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-11-01T16:57:22.1666445+00:00","complete":true,"records":1766,"lastAttemptAt":"2026-11-01T16:57:22.1666445+00:00","lastSuccessAt":"2026-11-01T16:57:22.3213113+00:00","error":null,"lastVerifiedAt":"2026-11-01T16:57:22.3213122+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-aece262bb10a694367a43c24d730aa8e8dc171723eaec4c15cdd32f04bda103f-585642db5fd5f5a045fdfca4b18984aef177ee17d65cc7f04f45379403194285","complete":true,"records":417664,"lastAttemptAt":"2026-11-01T16:57:21.0753446+00:00","lastSuccessAt":"2026-11-01T16:57:21.0470885+00:00","error":null,"lastVerifiedAt":"2026-11-01T16:57:21.0753446+00:00","snapshotPublishedAt":"2026-11-01T16:32:09+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-d4277393664142728b582cdd9a5ee17c","complete":false,"records":13568,"lastAttemptAt":"2026-11-01T17:08:13.5810621+00:00","lastSuccessAt":"2026-11-01T17:08:13.7268232+00:00","error":null,"lastVerifiedAt":"2026-11-01T17:08:13.7268232+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-11-01T16:57:22.1666445+00:00","complete":true,"records":1095,"lastAttemptAt":"2026-11-01T16:57:22.1666445+00:00","lastSuccessAt":"2026-11-01T16:57:22.3220592+00:00","error":null,"lastVerifiedAt":"2026-11-01T16:57:22.3220593+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-86ffd04e61a14524b2bdedd1ba2e339d","complete":true,"records":13580,"lastAttemptAt":"2026-11-01T16:57:47.7627092+00:00","lastSuccessAt":"2026-11-01T16:57:47.759+00:00","error":null,"lastVerifiedAt":"2026-11-01T16:57:47.759+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13637,"expectedIdentifiers":13637,"failedIdentifiers":0},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-21dcd6662970dfea02e4ea60ee637115e8d92664947484d2b9276b3f6568a84f","complete":true,"records":9815,"lastAttemptAt":"2026-11-01T16:57:21.7362922+00:00","lastSuccessAt":"2026-10-30T23:47:34.1817587+00:00","error":null,"lastVerifiedAt":"2026-11-01T16:57:21.7362922+00:00","snapshotPublishedAt":"2026-10-30T23:33:17+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-2de9ccc5290f060c7aa63f89c25dd76f655a64ba1aba7c05c97fa3bee4f09899","complete":true,"records":1967,"lastAttemptAt":"2026-11-01T16:57:21.2364439+00:00","lastSuccessAt":"2026-10-28T20:55:34.2982937+00:00","error":null,"lastVerifiedAt":"2026-11-01T16:57:21.2364439+00:00","snapshotPublishedAt":"2026-10-28T20:03:08+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-f95f76cd406ae5bae3de632ad37fd2d5160b44f5e6b51748ac6f8f0c0c88e72b","complete":true,"records":3028,"lastAttemptAt":"2026-11-01T16:57:22.1252506+00:00","lastSuccessAt":"2026-10-30T23:47:38.4914494+00:00","error":null,"lastVerifiedAt":"2026-11-01T16:57:22.1252506+00:00","snapshotPublishedAt":"2026-10-30T23:18:12+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-55acacd40a7aab88cf530cfddf98233a5d800cfc6bb1883653ecf5bee50f4426","complete":true,"records":230996,"lastAttemptAt":"2026-11-01T16:57:21.6223649+00:00","lastSuccessAt":"2026-11-01T09:06:49.6961926+00:00","error":null,"lastVerifiedAt":"2026-11-01T16:57:21.6223649+00:00","snapshotPublishedAt":"2026-11-01T08:33:39+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}