CVE-2026-40343

The record

free5GC UDR is the user data repository (UDR) for free5GC, an an open-source project for 5th generation (5G) mobile core networks. In versions up to and including 1.4.2, a fail-open request handling flaw in the UDR service causes the `/nudr-dr/v2/policy-data/subs-to-notify` POST handler to continue processing requests even after request body retrieval or deserialization errors. This may allow unintended creation of Policy Data notification subscriptions with invalid, empty, or partially processed input, depending on downstream processor behavior. As of time of publication, a patched version is not available.

Affected packages

Related vulnerabilities

• CVE-2026-100352 kin-openapi is a Go project for handling OpenAPI files. CWE-754
• CVE-2026-98161 In the Linux kernel, the following vulnerability has been resolved: nvdimm: pmem: keep… CWE-754
• CVE-2026-77411 RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. CWE-754
• CVE-2026-87645 Improper state validation in Safebrowsing in Google Chrome prior to 153.0.8010.36 allowed… CWE-754
• CVE-2026-87548 Improper state validation in Installer in Google Chrome prior to 153.0.8010.36 allowed a… CWE-754
• CVE-2026-87532 Improper state validation in Safebrowsing in Google Chrome prior to 153.0.8010.36 allowed… CWE-754
• CVE-2026-73314 XenForo before 2.3.13 contains a signature verification logic error in the PayPal REST… CWE-754
• CVE-2026-85014 undici's experimental WebSocketStream client crashes the whole Node.js process when a… CWE-754