free5GC is an open‑source implementation of the 5G core network. In versions 4.2.1 and earlier of its UDR service, the PUT handler for updating Policy Data notification subscriptions at /nudr-dr/v2/policy-data/subs-to-notify/{subsId} does not terminate after encountering request body parsing errors. The handler continues processing with an uninitialized or partially initialized PolicyDataSubscription object, resulting in a fail‑open behavior that can unintentionally modify existing subscription data. This flaw corresponds to CWE-636 (Fail‑Open) and CWE-754 (Missing Input Validation) and could compromise the confidentiality and integrity of subscription records.

The vulnerable component is free5gc’s UDR service, specifically versions 4.2.1 and all earlier releases. Attackers who can reach the exposed HTTP endpoint can exploit the defect on any installation running those versions; it does not depend on special authentication levels beyond normal service access.

The CVSS score is 6.9, indicating moderate severity. No EPSS value is available and the vulnerability is not listed in the CISA KEV catalog. Attackers may exploit the flaw by sending malformed or empty payloads to the endpoint, thereby triggering the fail‑open path. The vulnerability is remote and can be executed over the network if the endpoint is reachable, though the exact attack vector is inferred from the description.