Vulnerability-Lookup

CVE-2026-42082 (GCVE-0-2026-42082)

Vulnerability from cvelistv5 – Published: 2026-05-27 15:59 – Updated: 2026-05-28 14:47

Title

free5GC: Missing Concurrent NAS SMC Validation During NGAP Handover

Summary

free5GC is an open-source implementation of the 5G core network. Prior to 4.2.2, the AMF in Free5GC does not enforce the concurrent security procedure rules defined in 3GPP TS 33.501 §6.9.5.1. The AMF does not check for ongoing N2 handover procedures before initiating a NAS Security Mode Command, and vice versa. This can lead to mismatches between NAS and AS security contexts in the network and the UE. This vulnerability is fixed in 4.2.2.

Severity

3.7 (Low)


                        
                          CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-05-28 14:47 UTC

CWE

CWE-358 - Improperly Implemented Security Check for Standard

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7745 records in the last 180 days details

References

1 reference

URL	Tags
https://github.com/free5gc/free5gc/security/advis…	x_refsource_CONFIRM

Impacted products

1 product

Vendor	Product	Version	CPE status
free5gc	free5gc	Affected: < 4.2.2	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-42082",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-28T14:47:10.325265Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-28T14:47:44.462Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/free5gc/free5gc/security/advisories/GHSA-vrrx-58h3-prmh"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "free5gc",
          "vendor": "free5gc",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 4.2.2"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "free5GC is an open-source implementation of the 5G core network. Prior to 4.2.2, the AMF in Free5GC does not enforce the concurrent security procedure rules defined in 3GPP TS 33.501 \u00a76.9.5.1. The AMF does not check for ongoing N2 handover procedures before initiating a NAS Security Mode Command, and vice versa. This can lead to mismatches between NAS and AS security contexts in the network and the UE. This vulnerability is fixed in 4.2.2."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "ADJACENT_NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-358",
              "description": "CWE-358: Improperly Implemented Security Check for Standard",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-27T15:59:21.228Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/free5gc/free5gc/security/advisories/GHSA-vrrx-58h3-prmh",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/free5gc/free5gc/security/advisories/GHSA-vrrx-58h3-prmh"
        }
      ],
      "source": {
        "advisory": "GHSA-vrrx-58h3-prmh",
        "discovery": "UNKNOWN"
      },
      "title": "free5GC: Missing Concurrent NAS SMC Validation During NGAP Handover"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-42082",
    "datePublished": "2026-05-27T15:59:21.228Z",
    "dateReserved": "2026-04-23T19:17:30.565Z",
    "dateUpdated": "2026-05-28T14:47:44.462Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-42082",
      "date": "2026-10-17",
      "epss": "0.00251",
      "percentile": "0.15325"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "product": "free5gc",
                "vendor": "free5gc",
                "versions": [
                  {
                    "status": "affected",
                    "version": "\u003c 4.2.2"
                  }
                ]
              }
            ],
            "source": "security-advisories@github.com"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:free5gc:free5gc:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "EF7EBB95-EB4E-44C5-BF0A-9C99B0A7775F",
                    "versionEndExcluding": "4.2.2",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "free5GC is an open-source implementation of the 5G core network. Prior to 4.2.2, the AMF in Free5GC does not enforce the concurrent security procedure rules defined in 3GPP TS 33.501 \u00a76.9.5.1. The AMF does not check for ongoing N2 handover procedures before initiating a NAS Security Mode Command, and vice versa. This can lead to mismatches between NAS and AS security contexts in the network and the UE. This vulnerability is fixed in 4.2.2."
          },
          {
            "lang": "es",
            "value": "free5GC es una implementaci\u00f3n de c\u00f3digo abierto de la red central 5G. Antes de 4.2.2, el AMF en Free5GC no aplica las reglas de procedimiento de seguridad concurrentes definidas en 3GPP TS 33.501 \u00a76.9.5.1. El AMF no verifica la existencia de procedimientos de traspaso N2 en curso antes de iniciar un comando de modo de seguridad NAS, y viceversa. Esto puede llevar a desajustes entre los contextos de seguridad NAS y AS en la red y el UE. Esta vulnerabilidad est\u00e1 corregida en 4.2.2."
          }
        ],
        "id": "CVE-2026-42082",
        "lastModified": "2026-10-14T20:10:00.190",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "HIGH",
                "attackVector": "ADJACENT_NETWORK",
                "availabilityImpact": "LOW",
                "baseScore": 3.7,
                "baseSeverity": "LOW",
                "confidentialityImpact": "NONE",
                "integrityImpact": "LOW",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L",
                "version": "3.1"
              },
              "exploitabilityScore": 1.2,
              "impactScore": 2.5,
              "source": "security-advisories@github.com",
              "type": "Secondary"
            },
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "LOW",
                "baseScore": 5.4,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "NONE",
                "integrityImpact": "LOW",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L",
                "version": "3.1"
              },
              "exploitabilityScore": 2.8,
              "impactScore": 2.5,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-42082",
                "options": [
                  {
                    "exploitation": "poc"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-28T14:47:10.325265Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-05-27T17:16:35.180",
        "references": [
          {
            "source": "security-advisories@github.com",
            "tags": [
              "Exploit",
              "Vendor Advisory"
            ],
            "url": "https://github.com/free5gc/free5gc/security/advisories/GHSA-vrrx-58h3-prmh"
          },
          {
            "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
            "tags": [
              "Exploit",
              "Vendor Advisory"
            ],
            "url": "https://github.com/free5gc/free5gc/security/advisories/GHSA-vrrx-58h3-prmh"
          }
        ],
        "sourceIdentifier": "security-advisories@github.com",
        "vulnStatus": "Analyzed",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-358"
              }
            ],
            "source": "security-advisories@github.com",
            "type": "Secondary"
          }
        ]
      }
    },
    "redhat_vex": {
      "current_release_date": "2026-05-28T20:13:18+00:00",
      "cve": "CVE-2026-42082",
      "id": "CVE-2026-42082",
      "initial_release_date": "2026-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "free5GC: Missing Concurrent NAS SMC Validation During NGAP Handover",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42082.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-42082",
                    "options": [
                      {
                        "Exploitation": "poc"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-05-28T14:47:10.325265Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-05-28T14:47:30.160Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "references": [
              {
                "tags": [
                  "exploit"
                ],
                "url": "https://github.com/free5gc/free5gc/security/advisories/GHSA-vrrx-58h3-prmh"
              }
            ],
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "product": "free5gc",
              "vendor": "free5gc",
              "versions": [
                {
                  "status": "affected",
                  "version": "\u003c 4.2.2"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "free5GC is an open-source implementation of the 5G core network. Prior to 4.2.2, the AMF in Free5GC does not enforce the concurrent security procedure rules defined in 3GPP TS 33.501 \u00a76.9.5.1. The AMF does not check for ongoing N2 handover procedures before initiating a NAS Security Mode Command, and vice versa. This can lead to mismatches between NAS and AS security contexts in the network and the UE. This vulnerability is fixed in 4.2.2."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "HIGH",
                "attackVector": "ADJACENT_NETWORK",
                "availabilityImpact": "LOW",
                "baseScore": 3.7,
                "baseSeverity": "LOW",
                "confidentialityImpact": "NONE",
                "integrityImpact": "LOW",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L",
                "version": "3.1"
              }
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-358",
                  "description": "CWE-358: Improperly Implemented Security Check for Standard",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-05-27T15:59:21.228Z",
            "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
            "shortName": "GitHub_M"
          },
          "references": [
            {
              "name": "https://github.com/free5gc/free5gc/security/advisories/GHSA-vrrx-58h3-prmh",
              "tags": [
                "x_refsource_CONFIRM"
              ],
              "url": "https://github.com/free5gc/free5gc/security/advisories/GHSA-vrrx-58h3-prmh"
            }
          ],
          "source": {
            "advisory": "GHSA-vrrx-58h3-prmh",
            "discovery": "UNKNOWN"
          },
          "title": "free5GC: Missing Concurrent NAS SMC Validation During NGAP Handover"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "assignerShortName": "GitHub_M",
        "cveId": "CVE-2026-42082",
        "datePublished": "2026-05-27T15:59:21.228Z",
        "dateReserved": "2026-04-23T19:17:30.565Z",
        "dateUpdated": "2026-05-28T14:47:44.462Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-42082

Vulnerability from fkie_nvd - Published: 2026-05-27 17:16 - Updated: 2026-10-14 20:10

Severity

3.7 (Low) - CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L
5.4 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/free5gc/free5gc/security/advisories/GHSA-vrrx-58h3-prmh	Exploit, Vendor Advisory
	134c704f-9b21-4f2e-91b3-4a467353bcc0	https://github.com/free5gc/free5gc/security/advisories/GHSA-vrrx-58h3-prmh	Exploit, Vendor Advisory

Impacted products

	Vendor	Product	Version
	free5gc	free5gc	*

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "free5gc",
          "vendor": "free5gc",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 4.2.2"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:free5gc:free5gc:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "EF7EBB95-EB4E-44C5-BF0A-9C99B0A7775F",
              "versionEndExcluding": "4.2.2",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "free5GC is an open-source implementation of the 5G core network. Prior to 4.2.2, the AMF in Free5GC does not enforce the concurrent security procedure rules defined in 3GPP TS 33.501 \u00a76.9.5.1. The AMF does not check for ongoing N2 handover procedures before initiating a NAS Security Mode Command, and vice versa. This can lead to mismatches between NAS and AS security contexts in the network and the UE. This vulnerability is fixed in 4.2.2."
    },
    {
      "lang": "es",
      "value": "free5GC es una implementaci\u00f3n de c\u00f3digo abierto de la red central 5G. Antes de 4.2.2, el AMF en Free5GC no aplica las reglas de procedimiento de seguridad concurrentes definidas en 3GPP TS 33.501 \u00a76.9.5.1. El AMF no verifica la existencia de procedimientos de traspaso N2 en curso antes de iniciar un comando de modo de seguridad NAS, y viceversa. Esto puede llevar a desajustes entre los contextos de seguridad NAS y AS en la red y el UE. Esta vulnerabilidad est\u00e1 corregida en 4.2.2."
    }
  ],
  "id": "CVE-2026-42082",
  "lastModified": "2026-10-14T20:10:00.190",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "ADJACENT_NETWORK",
          "availabilityImpact": "LOW",
          "baseScore": 3.7,
          "baseSeverity": "LOW",
          "confidentialityImpact": "NONE",
          "integrityImpact": "LOW",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L",
          "version": "3.1"
        },
        "exploitabilityScore": 1.2,
        "impactScore": 2.5,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "LOW",
          "baseScore": 5.4,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "NONE",
          "integrityImpact": "LOW",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 2.5,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-42082",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-05-28T14:47:10.325265Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-05-27T17:16:35.180",
  "references": [
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ],
      "url": "https://github.com/free5gc/free5gc/security/advisories/GHSA-vrrx-58h3-prmh"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ],
      "url": "https://github.com/free5gc/free5gc/security/advisories/GHSA-vrrx-58h3-prmh"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-358"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

GHSA-VRRX-58H3-PRMH

Vulnerability from github – Published: 2026-05-07 01:56 – Updated: 2026-06-08 23:46

Summary

Free5GC AMF has Missing Concurrent NAS SMC Validation During NGAP Handover

Details

Summary

The AMF in Free5GC v4.2.1 does not enforce the concurrent security procedure rules defined in 3GPP TS 33.501 §6.9.5.1. The AMF does not check for ongoing N2 handover procedures before initiating a NAS Security Mode Command, and vice versa. This can lead to mismatches between NAS and AS security contexts in the network and the UE.

Details

Vulnerability Type: CWE-358 (Improperly Implemented Security Check for Standard)

Affected File: internal/ngap/handler.go — handleHandoverRequiredMain() and internal/gmm/sm.go — SecurityMode()

Root Cause:

3GPP TS 33.501 §6.9.5.1 states:

"Concurrent runs of security procedures may, in certain situations, lead to mismatches between security contexts in the network and the UE. In order to avoid such mismatches, the following rules shall be adhered to: 1. AMF shall not initiate any of the N2 procedures including a new key towards a UE if a NAS Security Mode Command procedure is ongoing with the UE. 2. The AMF shall not initiate a NAS Security Mode Command towards a UE if one of the N2 procedures including a new key is ongoing with the UE."

Free5GC AMF uses an OnGoing state tracking mechanism (SetOnGoing(), GetOnGoing()) with OnGoingProcedureN2Handover type. However, the cross-procedure checks required by §6.9.5.1 are not implemented:

Rule 2 violation: SecurityMode() in internal/gmm/sm.go sends SMC on EntryEvent without checking if N2 handover is ongoing.

Rule 1 violation: handleHandoverRequiredMain() in internal/ngap/handler.go calls SetOnGoing(OnGoingProcedureN2Handover) without checking if SMC is ongoing.

Why NH/NCC and SMC are related:

SMC activates a new KAMF, which changes the basis for NH key derivation. The N2 HandoverRequest includes NH/NCC derived from the old KAMF. If both procedures run concurrently, the target gNB and UE derive different KgNB keys, breaking AS security.

PoC

Source code evidence:

Free5GC AMF internal/gmm/sm.go — SecurityMode():

func SecurityMode(state *fsm.State, event fsm.EventType, args fsm.ArgsType) {
    switch event {
    case fsm.EntryEvent:
        // No check for OnGoing N2 procedure
        // Directly proceeds to SMC

Free5GC AMF internal/ngap/handler.go — handleHandoverRequiredMain():

amfUe.SetOnGoing(sourceUe.Ran.AnType, &context.OnGoing{
    Procedure: context.OnGoingProcedureN2Handover,
})
// No check for ongoing SMC before setting N2

Packet Evidence (pcap available):

Packet	Time	Message	Description
#1	0.000s	HandoverRequired	gNB_A requests handover
#18	0.002s	HandoverRequest	N2 started (NH/NCC included)
		(no response from gNB_B)	N2 ongoing
#28	2.062s	Registration request	UE re-registers (same SUPI)
#63	2.069s	Authentication request
#64	2.070s	Authentication response
#71	2.072s	Security mode command	SMC during N2 ongoing = Rule 2 violation
NGAPHandover-N2-SMC-Concurrent.zip

Impact

Integrity (MEDIUM): Concurrent NAS and AS security procedures can cause security context mismatches between UE, AMF, and gNB. The SMC activates a new KAMF while the N2 HandoverRequest carries NH/NCC derived from the old KAMF, resulting in KgNB derivation mismatch.

Availability (LOW): Security context mismatch may cause handover failure or security verification failures.

Severity

3.7 (Low)


                  
                    CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/free5gc/amf"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "1.4.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-42082"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-358"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-05-07T01:56:13Z",
    "nvd_published_at": "2026-05-27T17:16:35Z",
    "severity": "LOW"
  },
  "details": "### Summary\n\nThe AMF in Free5GC v4.2.1 does not enforce the concurrent security procedure rules defined in 3GPP TS 33.501 \u00a76.9.5.1. The AMF does not check for ongoing N2 handover procedures before initiating a NAS Security Mode Command, and vice versa. This can lead to mismatches between NAS and AS security contexts in the network and the UE.\n\n### Details\n\n**Vulnerability Type:** CWE-358 (Improperly Implemented Security Check for Standard)\n\n**Affected File:** `internal/ngap/handler.go` \u2014 `handleHandoverRequiredMain()` and `internal/gmm/sm.go` \u2014 `SecurityMode()`\n\n**Root Cause:**\n\n3GPP TS 33.501 \u00a76.9.5.1 states:\n\n\u003e \"Concurrent runs of security procedures may, in certain situations, lead to mismatches between security contexts in the network and the UE. In order to avoid such mismatches, the following rules shall be adhered to:\n\u003e 1. AMF shall not initiate any of the N2 procedures including a new key towards a UE if a NAS Security Mode Command procedure is ongoing with the UE.\n\u003e 2. The AMF shall not initiate a NAS Security Mode Command towards a UE if one of the N2 procedures including a new key is ongoing with the UE.\"\n\nFree5GC AMF uses an `OnGoing` state tracking mechanism (`SetOnGoing()`, `GetOnGoing()`) with `OnGoingProcedureN2Handover` type. However, the cross-procedure checks required by \u00a76.9.5.1 are not implemented:\n\n**Rule 2 violation:**\n`SecurityMode()` in `internal/gmm/sm.go` sends SMC on `EntryEvent` without checking if N2 handover is ongoing.\n\n**Rule 1 violation:**\n`handleHandoverRequiredMain()` in `internal/ngap/handler.go` calls `SetOnGoing(OnGoingProcedureN2Handover)` without checking if SMC is ongoing.\n\n**Why NH/NCC and SMC are related:**\n\nSMC activates a new KAMF, which changes the basis for NH key derivation. The N2 HandoverRequest includes NH/NCC derived from the old KAMF. If both procedures run concurrently, the target gNB and UE derive different KgNB keys, breaking AS security.\n\n### PoC\n\n**Source code evidence:**\n\nFree5GC AMF `internal/gmm/sm.go` \u2014 `SecurityMode()`:\n```go\nfunc SecurityMode(state *fsm.State, event fsm.EventType, args fsm.ArgsType) {\n    switch event {\n    case fsm.EntryEvent:\n        // No check for OnGoing N2 procedure\n        // Directly proceeds to SMC\n```\n\nFree5GC AMF `internal/ngap/handler.go` \u2014 `handleHandoverRequiredMain()`:\n```go\namfUe.SetOnGoing(sourceUe.Ran.AnType, \u0026context.OnGoing{\n    Procedure: context.OnGoingProcedureN2Handover,\n})\n// No check for ongoing SMC before setting N2\n```\n\n**Packet Evidence (pcap available):**\n\n| Packet | Time | Message | Description |\n|--------|------|---------|-------------|\n| #1 | 0.000s | HandoverRequired | gNB_A requests handover |\n| #18 | 0.002s | **HandoverRequest** | **N2 started (NH/NCC included)** |\n| | | *(no response from gNB_B)* | **N2 ongoing** |\n| #28 | 2.062s | Registration request | UE re-registers (same SUPI) |\n| #63 | 2.069s | Authentication request | |\n| #64 | 2.070s | Authentication response | |\n| #71 | 2.072s | **Security mode command** | **SMC during N2 ongoing = Rule 2 violation** |\n[NGAPHandover-N2-SMC-Concurrent.zip](https://github.com/user-attachments/files/26735421/NGAPHandover-N2-SMC-Concurrent.zip)\n\n\n### Impact\n\n**Integrity (MEDIUM):** Concurrent NAS and AS security procedures can cause security context mismatches between UE, AMF, and gNB. The SMC activates a new KAMF while the N2 HandoverRequest carries NH/NCC derived from the old KAMF, resulting in KgNB derivation mismatch.\n\n**Availability (LOW):** Security context mismatch may cause handover failure or security verification failures.",
  "id": "GHSA-vrrx-58h3-prmh",
  "modified": "2026-06-08T23:46:41Z",
  "published": "2026-05-07T01:56:13Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/free5gc/free5gc/security/advisories/GHSA-vrrx-58h3-prmh"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42082"
    },
    {
      "type": "WEB",
      "url": "https://github.com/free5gc/amf/blame/v1.4.3/internal/gmm/sm.go"
    },
    {
      "type": "WEB",
      "url": "https://github.com/free5gc/amf/blame/v1.4.3/internal/ngap/handler.go"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/free5gc/free5gc"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Free5GC AMF has Missing Concurrent NAS SMC Validation During NGAP Handover "
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-42082 (GCVE-0-2026-42082)

FKIE_CVE-2026-42082

GHSA-VRRX-58H3-PRMH

Summary

Details

PoC

Impact

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour