The vulnerability is a nil‑pointer dereference in the free5GC UDR nudr‑dr DELETE /subscription‑data/{ueId}/{servingPlmnId}/ee‑subscriptions/{subsId}/amf‑subscriptions handler. A malicious actor can authenticate, create an EE‑subscription, then issue a DELETE request with a missing subsId. The code attempts to read two fields from the missing entry, triggering a panic that Gin recovers as an HTTP 500 error. Repeated requests can keep the endpoint in a panicable state, effectively denying service. The weakness is identified as CWE‑476.

The affected product is free5GC, the open‑source 5G core network implementation. All releases prior to version 4.2.2 are affected, as the vulnerability is fixed in 4.2.2. This includes the free5gc:free5gc UDR component.

The CVSS base score of 4.3 classifies the risk as moderate, but the lack of an EPSS score and the absence from the CISA KEV catalog suggest no known widespread exploitation yet. Nevertheless, the exploit requires a single authenticated request after an EE‑subscription create, making it a relatively straightforward local or remote authenticated attack. The denial of service could disrupt network services for any UE whose subscriptions are impacted.