CVE-2026-27643 - Vulnerability Analysis

Overview

free5GC UDR <= 1.4.1 contains an information disclosure caused by leaking internal parsing error details in the NEF component, letting remote attackers perform service fingerprinting, exploit requires access to Nnef_PfdManagement service.

Severity & Score

Impact

Attackers can gain internal error details aiding in service fingerprinting, potentially facilitating further attacks.

Mitigation

Apply the patch from free5gc/udr pull request 56.

References

• https://github.com/free5gc/udr/pull/56
• https://github.com/free5gc/free5gc/issues/753
• https://github.com/free5gc/free5gc/security/advisories/GHSA-6468-f87j-6g82
• https://github.com/free5gc/udr/commit/754d23b03755ad59077ed529ce3b971e477080c4

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner