The vulnerability is a Go panic caused by an unprotected type assertion to *udr_context.UESubsData when the ueId does not exist in the UESubsCollection. Because of the missing nil check, the application produces an interface conversion panic that Gin's recovery converts into an HTTP 500 response. This flaw is a type‑mismatch error (CWE‑704) combined with improper error handling (CWE‑754) and allows an attacker to repeatedly trigger a server crash, resulting in service disruption.

Affected are installations of the free5GC core network implementation before version 4.2.2. The problematic DELETE endpoint is /subscription-data/{ueId}/{servingPlmnId}/ee-subscriptions/{subsId}/amf-subscriptions. The issue is fixed starting with free5GC 4.2.2; any release earlier than that remains vulnerable.

The CVSS score is 6.5, indicating moderate severity. EPSS is not available, and the vulnerability is not listed in CISA KEV. An attacker must first authenticate to the UDR service to send a DELETE request with a non‑existent ueId. Successful exploitation results in a server panic and repeated HTTP 500 responses until the service is restarted, effectively denying service to legitimate users. The risk is therefore a remote authenticated denial of service.