CVE-2026-42082

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-42082

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-42082.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-42082

Aliases

Published

2026-05-27T15:59:21.228Z

Modified

2026-07-15T01:49:17.990431070Z

Severity

3.7 (Low) CVSS_V3 - CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L CVSS Calculator

Summary

free5GC: Missing Concurrent NAS SMC Validation During NGAP Handover

Details

free5GC is an open-source implementation of the 5G core network. Prior to 4.2.2, the AMF in Free5GC does not enforce the concurrent security procedure rules defined in 3GPP TS 33.501 §6.9.5.1. The AMF does not check for ongoing N2 handover procedures before initiating a NAS Security Mode Command, and vice versa. This can lead to mismatches between NAS and AS security contexts in the network and the UE. This vulnerability is fixed in 4.2.2.

Database specific

{
    "cwe_ids": [
        "CWE-358"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/42xxx/CVE-2026-42082.json",
    "cna_assigner": "GitHub_M"
}

References

Affected packages

Git / github.com/free5gc/free5gc

Affected ranges

Type

GIT

Repo

https://github.com/free5gc/free5gc

Events

Introduced

Fixed

8b0f4445fc931638fb624463ce3572a203517679

Database specific

{
    "cpe": "cpe:2.3:a:free5gc:free5gc:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "4.2.2"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "CPE_RANGE"
    ]
}

Affected versions

v3.*

v3.0.5

v3.0.6

v3.0.7

v3.1.0

v3.1.1

v3.2.0

v3.2.1

v3.3.0

v3.4.0

v3.4.1

v3.4.2

v3.4.3

v3.4.4

v3.4.5

v4.*

v4.0.0

v4.0.1

v4.1.0

v4.2.0

v4.2.1

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-42082.json"