https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 05 Oct 2026 21:37:48 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-291881 EUVD-2026-291881 https://cve.radiocsirt.org/vuln/euvd-2026-291881 https://cve.radiocsirt.org/vuln/fkie_cve-2026-40249 <p>free5GC is an open-source implementation of the 5G core network. In versions 4.2.1 and below of the UDR service, the PUT handler for updating Policy Data notification subscriptions at /nudr-dr/v2/policy-data/subs-to-notify/{subsId} does not return after request body retrieval or deserialization errors. Although HTTP 500 or 400 error responses are sent, execution continues and the processor is invoked with a potentially uninitialized or partially initialized PolicyDataSubscription object. This fail-open behavior may allow unintended modification of existing Policy Data notification subscriptions with invalid or empty input, depending on downstream processor and storage behavior. A patched version was not available at the time of publication.</p> <p>free5GC is an open-source implementation of the 5G core network. In versions 4.2.1 and below of the UDR service, the PUT handler for updating Policy Data notification subscriptions at /nudr-dr/v2/policy-data/subs-to-notify/{subsId} does not return after request body retrieval or deserialization errors. Although HTTP 500 or 400 error responses are sent, execution continues and the processor is invoked with a potentially uninitialized or partially initialized PolicyDataSubscription object. This fail-open behavior may allow unintended modification of existing Policy Data notification subscriptions with invalid or empty input, depending on downstream processor and storage behavior. A patched version was not available at the time of publication.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-40249 https://cve.radiocsirt.org/vuln/ghsa-gx38-8h33-pmxr <p><strong>Affected:</strong> Go: github.com/free5gc/udr</p> <p>### Summary A fail-open request handling flaw in the UDR service causes the `/nudr-dr/v2/policy-data/subs-to-notify/{subsId}` PUT handler to continue processing requests even after request body retrieval or deserialization errors.</p> <p>This may allow unintended modification of existing Policy Data notification subscriptions with invalid, empty, or partially processed input, depending on downstream processor behavior.</p> <p>### Details The endpoint `PUT /nudr-dr/v2/policy-data/subs-to-notify/{subsId}` is intended to update an existing Policy Data notification subscription only after the HTTP request body has been successfully read and parsed into a valid `PolicyDataSubscription` object. [file:93]</p> <p>In the free5GC UDR implementation, the function `HandlePolicyDataSubsToNotifySubsIdPut` in`NFs/udr/internal/sbi/api_datarepository.go` does not terminate execution after input-processing failures. [file:93]</p> <p>The request flow is:</p> <p>1. The handler calls `c.GetRawData()` to read the HTTP request body. [file:93] 2. If `GetRawData()` fails, the handler sends an HTTP 500 error response, but **does not return**. [file:93] 3. The handler then calls `openapi.Deserialize(policyDataSubscription, reqBody, &#34;application/json&#34;)`. [file:93] 4. If deserialization fails, the handler sends an HTTP 400 error response, but again **does not return**. [file:93] 5. Execution continues and the handler still invokes `s.Processor().PolicyDataSubsToNotifySubsIdPutProcedure(c, subsId, policyDataSubscription)`. [file:93]…</p> <p><strong>Affected:</strong> Go: github.com/free5gc/udr</p> <p>### Summary A fail-open request handling flaw in the UDR service causes the `/nudr-dr/v2/policy-data/subs-to-notify/{subsId}` PUT handler to continue processing requests even after request body retrieval or deserialization errors.</p> <p>This may allow unintended modification of existing Policy Data notification subscriptions with invalid, empty, or partially processed input, depending on downstream processor behavior.</p> <p>### Details The endpoint `PUT /nudr-dr/v2/policy-data/subs-to-notify/{subsId}` is intended to update an existing Policy Data notification subscription only after the HTTP request body has been successfully read and parsed into a valid `PolicyDataSubscription` object. [file:93]</p> <p>In the free5GC UDR implementation, the function `HandlePolicyDataSubsToNotifySubsIdPut` in`NFs/udr/internal/sbi/api_datarepository.go` does not terminate execution after input-processing failures. [file:93]</p> <p>The request flow is:</p> <p>1. The handler calls `c.GetRawData()` to read the HTTP request body. [file:93] 2. If `GetRawData()` fails, the handler sends an HTTP 500 error response, but **does not return**. [file:93] 3. The handler then calls `openapi.Deserialize(policyDataSubscription, reqBody, &#34;application/json&#34;)`. [file:93] 4. If deserialization fails, the handler sends an HTTP 400 error response, but again **does not return**. [file:93] 5. Execution continues and the handler still invokes `s.Processor().PolicyDataSubsToNotifySubsIdPutProcedure(c, subsId, policyDataSubscription)`. [file:93]…</p> https://cve.radiocsirt.org/vuln/ghsa-gx38-8h33-pmxr