Free5GC is an open-source Linux Foundation project for 5th generation (5G) mobile core networks. Versions 4.2.1 and below contain an information disclosure vuln…

Free5GC versions 4.2.1 and below contain an information disclosure vulnerability in the UDR service. The vulnerability allows unauthenticated attackers to retrieve sensitive subscriber identifiers (SUPI/IMSI values) through a parameterless HTTP GET request. The flaw occurs when the handler sends an HTTP 400 error but doesn't return, causing execution to continue and expose the full list of Traffic Influence Subscriptions. This undermines 5G privacy guarantees and the 3GPP SUCI concealment mechanism at the core network level.