---
id: CVE-2026-42081
title: free5GC is an open-source implementation of the 5G core network
summary: >-
  free5GC is an open-source implementation of the 5G core network. Prior to
  4.2.2, the AMF in Free5GC does not verify the UE Security Capabilities
  received in NGAP PathSwitchRequest messages against its locally stored values,
  as mandated b…
severity: medium
cvss: 6.1
cvssVector: 'CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:L'
cwe:
  - CWE-358
vendor: free5gc
product: free5gc
affected:
  - free5gc < 4.2.2
patched:
  - free5gc 4.2.2
published: '2026-05-27'
updated: '2026-10-14'
sourceUpdated: '2026-10-14T20:10:00.190'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-42081'
references:
  - url: 'https://github.com/free5gc/free5gc/security/advisories/GHSA-77x9-rf64-92gv'
    label: security-advisories@github.com
  - url: 'https://github.com/free5gc/free5gc/security/advisories/GHSA-77x9-rf64-92gv'
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
tags:
  - nvd
epss: 0.00284
epssPercentile: 0.19463
ingestedAt: '2026-10-14T20:53:12.327Z'
---

## Overview

free5GC is an open-source implementation of the 5G core network. Prior to 4.2.2, the AMF in Free5GC does not verify the UE Security Capabilities received in NGAP PathSwitchRequest messages against its locally stored values, as mandated by 3GPP TS 33.501 §6.7.3.1. A malicious gNB can overwrite the AMF's stored UE security capabilities with arbitrary values, which are then propagated in PathSwitchRequest Acknowledge messages and subsequent Handover Request messages. This leads to persistent handover denial-of-service for affected UEs. This vulnerability is fixed in 4.2.2.

## Affected

- `free5gc < 4.2.2`

## Remediation

Upgrade past the affected range:

- `free5gc 4.2.2`