The vulnerability affects free5GC's User Data Repository (UDR) component, specifically in versions up to 1.4.2. The issue is a failure to properly check for unusual or exceptional conditions (CWE-754) during request processing in the /nudr-dr/v2/policy-data/subs-to-notify POST handler. When errors occur in reading or deserializing the request body, the service improperly continues processing, potentially resulting in creation of notification subscriptions with invalid, empty, or partially processed data. This behavior depends on downstream processor handling. As of the publication date, no patch or remediation has been released.

The vulnerability may cause the UDR service to create unintended Policy Data notification subscriptions with invalid or incomplete input data. This could lead to inconsistent or incorrect policy data states within the 5G core network environment. There is no indication of privilege escalation, remote code execution, or denial of service from the provided data. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch is available at this time, users should monitor vendor communications for updates. Until a patch is released, consider implementing input validation or request filtering at network boundaries if feasible to reduce risk of malformed requests reaching the UDR service.