The flaw is a fail‑open handling bug in the UDR service that allows the /nudr-dr/v2/policy-data/subs-to-notify POST handler to continue processing requests after the request body has failed to be retrieved or deserialized. This can lead to unintentionally created subscriptions with invalid, empty, or partially processed input, potentially giving an attacker the ability to register unexpected notifications or alter data flow in the core network.

The vulnerability affects the free5gc UDR component in all releases up to and including version 1.4.2. No later releases have been identified as remedied at the time of publication.

The CVSS score of 6.9 indicates a medium severity risk. EPSS data is not available and the issue is not listed in the CISA KEV catalog, so current exploitation data is limited. The likely attack vector is remote, as the vulnerable endpoint is accessible over the network within the 5G core, allowing an attacker who can reach the UDR service to send crafted HTTP POST requests that trigger the fail‑open logic.