Go/github.com/free5gc/udr CVE-2026-40249: medium 5.3, EPSS 0.32%

free5gc UDR fail-open request handling in PolicyDataSubsToNotifySubsIdPut may allow unintended subscription updates after input errors in github.com/free5gc/udr

Action: No fix published. Pin and monitor.

Affected

introduced	fixed	last affected
0	-	-

Fixed versions

No fixed version in the source.

Sources

osv: GO-2026-5407
nvd: CVE-2026-40249
https://github.com/free5gc/free5gc/security/advisories/GHSA-gx38-8h33-pmxr

CVE-2026-40249 · published 2026-06-25T22:34:31Z · modified 2026-06-25T23:00:16.072699662Z · JSON