CVE-2026-27643

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-27643", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-02-20T22:02:30.029Z", "datePublished": "2026-02-24T00:21:18.510Z", "dateUpdated": "2026-02-26T14:36:45.483Z"}, "containers": {"cna": {"title": "free5GC has improper error handling in NEF with information exposure", "problemTypes": [{"descriptions": [{"cweId": "CWE-209", "lang": "en", "description": "CWE-209: Generation of Error Message Containing Sensitive Information", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 6.6, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U", "version": "4.0"}}], "references": [{"name": "https://github.com/free5gc/free5gc/security/advisories/GHSA-6468-f87j-6g82", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/free5gc/free5gc/security/advisories/GHSA-6468-f87j-6g82"}, {"name": "https://github.com/free5gc/free5gc/issues/753", "tags": ["x_refsource_MISC"], "url": "https://github.com/free5gc/free5gc/issues/753"}, {"name": "https://github.com/free5gc/udr/pull/56", "tags": ["x_refsource_MISC"], "url": "https://github.com/free5gc/udr/pull/56"}, {"name": "https://github.com/free5gc/udr/commit/754d23b03755ad59077ed529ce3b971e477080c4", "tags": ["x_refsource_MISC"], "url": "https://github.com/free5gc/udr/commit/754d23b03755ad59077ed529ce3b971e477080c4"}], "affected": [{"vendor": "free5gc", "product": "udr", "versions": [{"version": "<= 1.4.1", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-24T00:21:18.510Z"}, "descriptions": [{"lang": "en", "value": "free5GC UDR is the user data repository (UDR) for free5GC, an an open-source project for 5th generation (5G) mobile core networks. In versions up to and including 1.4.1, the NEF component reliably leaks internal parsing error details (e.g., invalid character 'n' after top-level value) to remote clients, which can aid attackers in service fingerprinting. All deployments of free5GC using the Nnef_PfdManagement service may be affected. free5gc/udr pull request 56 contains a patch for the issue. There is no direct workaround at the application level. The recommendation is to apply the provided patch."}], "source": {"advisory": "GHSA-6468-f87j-6g82", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-26T14:35:17.471786Z", "id": "CVE-2026-27643", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-26T14:36:45.483Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-27643", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-26T14:35:17.471786Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-26T14:35:57.336Z"}}], "cna": {"title": "free5GC has improper error handling in NEF with information exposure", "source": {"advisory": "GHSA-6468-f87j-6g82", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 6.6, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH"}}], "affected": [{"vendor": "free5gc", "product": "udr", "versions": [{"status": "affected", "version": "<= 1.4.1"}]}], "references": [{"url": "https://github.com/free5gc/free5gc/security/advisories/GHSA-6468-f87j-6g82", "name": "https://github.com/free5gc/free5gc/security/advisories/GHSA-6468-f87j-6g82", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/free5gc/free5gc/issues/753", "name": "https://github.com/free5gc/free5gc/issues/753", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/free5gc/udr/pull/56", "name": "https://github.com/free5gc/udr/pull/56", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/free5gc/udr/commit/754d23b03755ad59077ed529ce3b971e477080c4", "name": "https://github.com/free5gc/udr/commit/754d23b03755ad59077ed529ce3b971e477080c4", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "free5GC UDR is the user data repository (UDR) for free5GC, an an open-source project for 5th generation (5G) mobile core networks. In versions up to and including 1.4.1, the NEF component reliably leaks internal parsing error details (e.g., invalid character 'n' after top-level value) to remote clients, which can aid attackers in service fingerprinting. All deployments of free5GC using the Nnef_PfdManagement service may be affected. free5gc/udr pull request 56 contains a patch for the issue. There is no direct workaround at the application level. The recommendation is to apply the provided patch."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-209", "description": "CWE-209: Generation of Error Message Containing Sensitive Information"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-24T00:21:18.510Z"}}}, "cveMetadata": {"cveId": "CVE-2026-27643", "state": "PUBLISHED", "dateUpdated": "2026-02-26T14:36:45.483Z", "dateReserved": "2026-02-20T22:02:30.029Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-02-24T00:21:18.510Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "udr", "vendor": "free5gc", "versions": [{"status": "affected", "version": "<= 1.4.1"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:free5gc:udr:*:*:*:*:*:go:*:*", "matchCriteriaId": "A300D117-4FF5-4D72-8628-3BA0188B845E", "versionEndIncluding": "1.4.1", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "free5GC UDR is the user data repository (UDR) for free5GC, an an open-source project for 5th generation (5G) mobile core networks. In versions up to and including 1.4.1, the NEF component reliably leaks internal parsing error details (e.g., invalid character 'n' after top-level value) to remote clients, which can aid attackers in service fingerprinting. All deployments of free5GC using the Nnef_PfdManagement service may be affected. free5gc/udr pull request 56 contains a patch for the issue. There is no direct workaround at the application level. The recommendation is to apply the provided patch."}, {"lang": "es", "value": "free5GC UDR es el repositorio de datos de usuario (UDR) para free5GC, un proyecto de c\u00f3digo abierto para redes centrales m\u00f3viles de quinta generaci\u00f3n (5G). En versiones hasta la 1.4.1 inclusive, el componente NEF filtra de forma fiable detalles de errores de an\u00e1lisis internos (p. ej., car\u00e1cter no v\u00e1lido 'n' despu\u00e9s del valor de nivel superior) a clientes remotos, lo que puede ayudar a los atacantes en la huella digital de servicios. Todas las implementaciones de free5GC que utilizan el servicio Nnef_PfdManagement pueden verse afectadas. La solicitud de extracci\u00f3n 56 de free5gc/udr contiene un parche para el problema. No existe una soluci\u00f3n alternativa directa a nivel de aplicaci\u00f3n. La recomendaci\u00f3n es aplicar el parche proporcionado."}], "id": "CVE-2026-27643", "lastModified": "2026-06-17T10:27:26.790", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 6.6, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "UNREPORTED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-27643", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-02-26T14:35:17.471786Z", "version": "2.0.3"}}]}, "published": "2026-02-24T01:16:15.543", "references": [{"source": "security-advisories@github.com", "tags": ["Exploit", "Issue Tracking", "Patch", "Vendor Advisory"], "url": "https://github.com/free5gc/free5gc/issues/753"}, {"source": "security-advisories@github.com", "tags": ["Patch", "Vendor Advisory"], "url": "https://github.com/free5gc/free5gc/security/advisories/GHSA-6468-f87j-6g82"}, {"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/free5gc/udr/commit/754d23b03755ad59077ed529ce3b971e477080c4"}, {"source": "security-advisories@github.com", "tags": ["Issue Tracking", "Patch"], "url": "https://github.com/free5gc/udr/pull/56"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-209"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.4.1]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "product": "udr", "vendor": "free5gc"}], "analysis": {"en": {"generated_at": "2026-04-17T16:07:42.923512+00:00", "value": {"mitigation_remediation": ["Apply the patch from free5gc/udr pull request 56 (commit 754d23b0) to correct the error handling logic.", "Upgrade to free5GC UDR version 1.4.2 or later, which incorporates the fix.", "Configure the NEF service to suppress detailed error messages in responses, reducing information leakage if the patch cannot be applied immediately."], "summary": {"action": "Patch Deployment", "impact": "Information Disclosure"}, "threat_synthesis": {"affected_systems": "Affected systems are free5GC UDR deployments that use the Nnef_PfdManagement service, specifically versions up to and including 1.4.1. Any implementation of the free5GC stack that incorporates this NEF component is potentially exposed.", "description_and_impact": "The vulnerability is an improper error handling flaw in the NEF component of free5GC UDR. During parsing of network exposure function (NEF) requests, the component returns internal error details such as the invalid character position to remote clients. This exposes implementation specifics that could aid attackers in service fingerprinting, enabling more targeted attacks. The weakness maps to CWE-209 (Improper Output Neutralization for Security).", "risk_and_exploitability": "The CVSSv3 score of 6.6 indicates moderate severity. The EPSS score of less than 1% reflects a very low exploitation likelihood. The vulnerability is not listed in the CISA KEV catalog. Attackers can exploit the flaw remotely by sending malformed requests to the NEF endpoint; the server then leaks parsing error details. Because the information is second\u2011party and not actionable for direct code execution, the risk is primarily for reconnaissance. Patch or upgrade is recommended."}}}}, "created": "2026-02-24T09:54:22.961755+00:00", "updated": "2026-04-17T16:15:22.642382+00:00", "vendors": ["free5gc", "free5gc$PRODUCT$udr"]}