CVE-2026-42082 Details
Description
free5GC is an open-source implementation of the 5G core network. Prior to 4.2.2, the AMF in Free5GC does not enforce the concurrent security procedure rules defined in 3GPP TS 33.501 §6.9.5.1. The AMF does not check for ongoing N2 handover procedures before initiating a NAS Security Mode Command, and vice versa. This can lead to mismatches between NAS and AS security contexts in the network and the UE. This vulnerability is fixed in 4.2.2.
A vulnerability exists in free5GC versions through 4.2.1 within the Access and Mobility Management Function (AMF). The issue arises because the AMF fails to enforce the concurrent security procedure rules outlined in 3GPP TS 33.501 §6.9.5.1. Specifically, the AMF does not verify ongoing N2 handover procedures before initiating a NAS Security Mode Command, and vice versa. This oversight can create mismatches between the NAS and AS security contexts in the network and the User Equipment (UE).
Users can upgrade to free5GC version 4.2.2, where this vulnerability has been addressed.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed May 28, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/free5gc/free5gc/security/advisories/GHSA-vrrx-58h3-prmh | CISA-ADP | ExploitVendor Advisory |
| https://github.com/free5gc/free5gc/security/advisories/GHSA-vrrx-58h3-prmh | [email protected] | ExploitVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-358 | Improperly Implemented Security Check for Standard | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| free5gc free5gc | < 4.2.2 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 28, 2026 | Initial Analysis | [email protected] |
| May 28, 2026 | CVE Modified | CISA-ADP |
| May 27, 2026 | New CVE Received | [email protected] |