A nil pointer dereference in the DataChangeNotificationProcedure function of the free5GC UDM causes a runtime panic when processing a POST request to the /sdm-subscriptions endpoint; the flaw enables an attacker to force a complete service crash by sending a crafted request that includes path traversal sequences and a large JSON payload, resulting in a denial of service for 5G core network operations and requiring a service restart for recovery; the weakness is identified as CWE‑476 and CWE‑478.

All releases of free5GC UDM prior to version 1.4.2 are vulnerable; users running those versions are at risk until the patched release is deployed; the affected product is the UDM component in the free5GC open‑source 5G core network stack.

The CVSS base score of 8.7 indicates high severity, while the EPSS score of less than 1% suggests a low current probability of exploitation; the vulnerability is not listed in the CISA KEV catalog; based on the description, it is inferred that no authentication is required to send the crafted POST request to the /sdm-subscriptions endpoint, implying a low barrier to entry for remote attackers; successful exploitation would trigger a crash that persists until the service is manually restarted.