PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-42081 free5gc CVE debrief

A medium-severity vulnerability in free5GC's Access and Mobility Management Function (AMF) allows malicious gNodeBs to overwrite UE security capabilities, causing persistent handover denial-of-service. The AMF fails to validate UE Security Capabilities in NGAP PathSwitchRequest messages against locally stored values as required by 3GPP TS 33.501 §6.7.3.1. Arbitrary values propagate through PathSwitchRequest Acknowledge and subsequent Handover Request messages, disrupting mobility for affected UEs. The issue affects versions prior to 4.2.2; upgrading to 4.2.2 resolves the vulnerability.

Vendor
free5gc
Product
Unknown
CVSS
MEDIUM 6.1
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-27
Original CVE updated
2026-05-29
Advisory published
2026-05-27
Advisory updated
2026-05-29

Who should care

Telecommunications operators deploying free5GC-based 5G core networks, mobile network security engineers, and organizations managing private 5G infrastructure using free5GC components

Technical summary

The free5GC AMF component prior to 4.2.2 improperly handles UE Security Capabilities in NGAP PathSwitchRequest messages. Per 3GPP TS 33.501 §6.7.3.1, the AMF must verify received capabilities against stored values; this verification is absent. A malicious gNodeB can inject arbitrary security capability values that persist in the AMF's state and propagate to subsequent signaling messages (PathSwitchRequest Acknowledge, Handover Request). This causes affected UEs to experience persistent handover failures, constituting a denial-of-service condition. The attack requires adjacent network access (AV:A) but no privileges or user interaction. The vulnerability is classified under CWE-358 and carries a CVSS 3.1 score of 6.1 (Medium).

Defensive priority

medium

Recommended defensive actions

  • Upgrade free5GC to version 4.2.2 or later to obtain the security fix
  • Review AMF configuration to ensure NGAP message validation policies are enforced
  • Monitor for anomalous handover failures or UE mobility disruptions that may indicate exploitation
  • Validate gNodeB trust boundaries and implement network segmentation where possible
  • Audit UE security capability records for inconsistencies following any suspected compromise

Evidence notes

Vulnerability disclosed via GitHub Security Advisory and indexed by NVD. CVSS 3.1 vector AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:L yields score 6.1 (Medium). CWE-358 (Improperly Implemented Security Check for Standard) classified. Fix confirmed in free5GC 4.2.2.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-42081 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-42081

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-42081 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-42081

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.