free5GC does not verify UE Security Capabilities in NGAP PathSwitchRequest messages, allowing a malicious gNB to overwrite the AMF's stored capabilities. This flaw propagates incorrect security settings through PathSwitchRequest Acknowledge and subsequent Handover Request messages, causing persistent handover denial‑of‑service for affected UEs.

The affected product is the free5gc open‑source 5G core network implementation. Versions prior to 4.2.2 of the AMF contain the flaw; the issue is addressed in release 4.2.2.

The CVSS score of 6.1 indicates a moderate severity vulnerability, and the EPSS score is not available. It is not listed in the CISA KEV catalog. Likely exploitation requires a gNB within the same network to send forged NGAP PathSwitchRequest messages to the AMF. The attacker must have control over a gNB or compromise a legitimate network element, and then send crafted messages. Persistence of the denial‑of‑service comes from repeated handover attempts that repeatedly contain the tampered capabilities, which the AMF will forward to other network nodes.