What is CVE-2026-40343?

CVE-2026-40343 is a medium-severity vulnerability in Free5gc, classified under Improper Check for Unusual or Exceptional Conditions. CVSS score: 5.8/10. Published 2026-04-22.

How severe is CVE-2026-40343?

Medium severity. CVSS v3 base score is 5.8 out of 10.

Vulnerability in Free5gc

CVE-2026-40343

free5GC UDR is the user data repository (UDR) for free5GC, an an open-source project for 5th generation (5G) mobile core networks. In versions up to and including 1.4.2, a fail-open request handling flaw in the UDR service causes the `/nudr-dr/v2/policy-data/subs-to-notify` POST handler to continue processing requests even after request body retrieval or deserialization errors. This may allow unintended creation of Policy Data notification subscriptions with invalid, empty, or partially processed input, depending on downstream processor behavior. As of time of publication, a patched version is not available.

Published 2026-04-22 · last modified 2026-06-17.

CVSS v3 metric

CVSS v3 base score 5.8 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N.

EPSS exploit prediction

EPSS: 0.003 (21.5th percentile), scored 2026-09-30.

Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 21st percentile — 21.5% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS over last 30 days · oldest: 0.100 · newest: 0.003 · change: -0.096

Affected products

Free5gc
Free5gc Udr — versions <= 1.4.2

Weakness classification (CWE)

CWE-754 — Improper Check for Unusual or Exceptional Conditions

References

github.com/free5gc/free5gc/security/advisories/GHSA-jwch-w7wh-gqjm (Patch, Mitigation, Vendor Advisory)

Frequently asked questions

What is CVE-2026-40343?: CVE-2026-40343 is a medium-severity vulnerability in Free5gc, classified under Improper Check for Unusual or Exceptional Conditions. CVSS score: 5.8/10. Published 2026-04-22.
How severe is CVE-2026-40343?: Medium severity. CVSS v3 base score is 5.8 out of 10.