CVE-2026-42081 Details
Description
free5GC is an open-source implementation of the 5G core network. Prior to 4.2.2, the AMF in Free5GC does not verify the UE Security Capabilities received in NGAP PathSwitchRequest messages against its locally stored values, as mandated by 3GPP TS 33.501 §6.7.3.1. A malicious gNB can overwrite the AMF's stored UE security capabilities with arbitrary values, which are then propagated in PathSwitchRequest Acknowledge messages and subsequent Handover Request messages. This leads to persistent handover denial-of-service for affected UEs. This vulnerability is fixed in 4.2.2.
A vulnerability exists in the Access and Mobility Management Function (AMF) of free5GC versions through 4.2.1. The issue arises because the AMF does not properly verify User Equipment (UE) Security Capabilities received in NGAP PathSwitchRequest messages against its locally stored values, as required by 3GPP TS 33.501 §6.7.3.1. This flaw allows a malicious gNB to overwrite the AMF's stored UE security capabilities with arbitrary values. These corrupted values are then propagated in PathSwitchRequest Acknowledge messages and subsequent Handover Request messages, leading to a persistent handover denial-of-service for affected UEs.
Users can upgrade to free5GC version 4.2.2, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed May 27, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/free5gc/free5gc/security/advisories/GHSA-77x9-rf64-92gv | CISA-ADP | ExploitVendor Advisory |
| https://github.com/free5gc/free5gc/security/advisories/GHSA-77x9-rf64-92gv | [email protected] | ExploitVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-358 | Improperly Implemented Security Check for Standard | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| free5gc free5gc | < 4.2.2 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 29, 2026 | Initial Analysis | [email protected] |
| May 27, 2026 | CVE Modified | CISA-ADP |
| May 27, 2026 | New CVE Received | [email protected] |