# CVE-2026-42081: free5GC AMF improper security check in NGAP PathSwitchRequest

Source: https://junglewise.ai/threats/cve-2026-42081-free5gc-amf-improper-security-check-in-ngap-pathswitchrequest  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-27. Updated: 2026-06-09  
License: CC BY 4.0 with a link back

CVE-2026-42081 · Severity: medium · CVSS 6.1 · Published 2026-05-27

A vulnerability in the Free5GC Access and Mobility Management Function (AMF) allows a compromised or untrusted base station to disrupt mobile service for specific users. By sending a specially crafted network request, an attacker can corrupt the security settings stored for a mobile device, causing all future connection handovers to fail. This results in a persistent loss of cellular connectivity for the affected user until they manually re-register with the network.

Technologies: [github.com/free5gc/amf (Go)](https://junglewise.ai/threats/technologies/github-com-free5gc-amf). Vendors: [Go](https://junglewise.ai/threats/vendors/go).

## Quick answers

**Is CVE-2026-42081 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-42081 being exploited in the wild.

**How severe is CVE-2026-42081?** Medium severity, with a CVSS score of 6.1, published 27 May 2026.

**Which products and versions are affected?** github.com/free5gc/amf (Go) <= 1.4.3, SEMVER:introduced=0, SEMVER:introduced=0,last_affected=1.4.3.

**Is there a fix for CVE-2026-42081?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-42081 attacked?** It is attacked from the adjacent network, in a software library.

**Am I affected by CVE-2026-42081?** Check whether you run github.com/free5gc/amf (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The Access and Mobility Management Function (AMF) in Free5GC (v1.4.3 and earlier) fails to implement the verification requirements of 3GPP TS 33.501 §6.7.3.1. Specifically, the 'handlePathSwitchRequestMain' function in 'amf/internal/ngap/handler.go' unconditionally overwrites locally stored User Equipment (UE) Security Capabilities with values provided in an NGAP PathSwitchRequest message from a gNB. An attacker controlling a gNB can send a PathSwitchRequest with null or unsupported integrity/encryption algorithms. The AMF then propagates these corrupted capabilities to target gNBs in subsequent Handover Request messages, leading to mandatory handover rejections per TS 38.413 and resulting in a persistent DoS for the affected UE.

## Affected products

- free5gc amf <= 1.4.3

## Identifiers

- CVE-2026-42081
- GHSA-77x9-rf64-92gv
- GO-2026-5209

## Timeline

- 2026-05-07: advisory: GitHub Advisory GHSA-77x9-rf64-92gv published
- 2026-05-27: disclosed: NVD publication of CVE-2026-42081

## References

- [https://api.github.com/users/SJNA0414](https://api.github.com/users/SJNA0414)
- [https://github.com/SJNA0414](https://github.com/SJNA0414)
- [https://api.github.com/users/SJNA0414/gists%7B/gist_id%7D](https://api.github.com/users/SJNA0414/gists%7B/gist_id%7D)
- [https://api.github.com/users/SJNA0414/repos](https://api.github.com/users/SJNA0414/repos)
- [https://avatars.githubusercontent.com/u/197385222?v=4](https://avatars.githubusercontent.com/u/197385222?v=4)
- [https://api.github.com/users/SJNA0414/events%7B/privacy%7D](https://api.github.com/users/SJNA0414/events%7B/privacy%7D)

## Related threats

- [GO-2026-5767 - Free5GC AMF is vulnerable to DoS through its HandleRegistrationComplete function in github.com/free5gc/amf](https://junglewise.ai/threats/cve-2026-4531-free5gc-amf-is-vulnerable-to-dos-through-its)
- [free5GC AMF improper security check in concurrent procedures](https://junglewise.ai/threats/cve-2026-42082-free5gc-amf-improper-security-check-in-concurrent-procedures)
- [free5GC AMF: Missing default case in Content-Type switch in HTTPUEContextTransfer](https://junglewise.ai/threats/cve-2026-41136-free5gc-amf-missing-default-case-in-content-type-switch-in)
- [free5GC AMF denial of service vulnerability](https://junglewise.ai/threats/cve-2023-49391-free5gc-amf-denial-of-service-vulnerability)