The UDM component of free5GC mishandles PATCH requests to update sdm-subscriptions when the supi path parameter is empty. Instead of propagating the downstream 400 Bad Request from the UDR, it converts the response into a 500 Internal Server Error. This reversal exposes internal error‑handling behavior, preventing clients from distinguishing between client‑side errors and server failures. The weakness is classed as CWE‑209 Information Exposure.

All releases of free5GC prior to version 1.4.2, specifically the UDM service identified by the CPES cpe:2.3:a:free5gc:udm. The vendor product is free5gc:free5gc. No sub‑release details are provided beyond the major version, so any build before 1.4.2 is considered impacted.

The CVSS score of 8.7 marks the vulnerability as high severity, while an EPSS score of less than 1% and absence from KEV suggest limited current exploitation. The flaw can be triggered through external network traffic by sending a PATCH request with an empty supi value, leading to error‑handling leakage. Attackers could map server responses to infer service behavior, making the impact significant in reachable environments.