The vulnerability in Free5GC allows a remote attacker to trigger a denial of service by exploiting the HandleAuthenticationFailure function in the AMF component. This weakness permits an attacker to repeatedly provoke failures that overwhelm system resources, leading to unavailability of the AMF and potentially the entire network slice depending on the deployment. The flaw is classified as CWE‑400, indicating a resource exhaustion weakness. The impact manifests as a service outage, affecting network availability and disrupting business services that rely on 5G connectivity.

Free5GC versions 4.2.0 and earlier are affected. The issue is present in the AMF module of the Free5GC open source 5G core stack. No other vendors or product lines are listed as impacted.

The CVSS score of 7.5 places this vulnerability in the high-risk category. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog, suggesting no known large-scale exploit but retaining a high potential for exploitation. The attack vector is remote, inferred from the description, and likely occurs over network interfaces that the AMF exposes. An attacker with network access could invoke authentication failure scenarios repeatedly, exhausting resources and causing downtime.