3.7

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-42082

CVE-2026-42082: free5GC: Missing Concurrent NAS SMC Validation During NGAP Handover

free5GC is an open-source implementation of the 5G core network. Prior to 4.2.2, the AMF in Free5GC does not enforce the concurrent security procedure rules defined in 3GPP TS 33.501 §6.9.5.1. The AMF does not check for ongoing N2 handover procedures before initiating a NAS Security Mode Command, and vice versa. This can lead to mismatches between NAS and AS security contexts in the network and the UE. This vulnerability is fixed in 4.2.2.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-42082

CVE-2026-42082:

3.7

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation pocAutomatable NoTech Impact Partial

Select your environment

→SSVCDeferfix on upgrade

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/free5gc/amf	go	<= 1.4.3

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in the Free5GC Access and Mobility Management Function (AMF) and its failure to comply with 3GPP standards for concurrent security procedures. Specifically, the AMF does not correctly handle the interplay between N2 handover procedures and NAS Security Mode Command (SMC) procedures, as required by 3GPP TS 33.501 §6.9.5.1.

The root cause is a lack of cross-procedural checks in two key functions:

handleHandoverRequiredMain in internal/ngap/handler.go: This function is responsible for initiating the N2 handover procedure. The vulnerability occurs because the function sets the OnGoingProcedureN2Handover state without first checking if a NAS SMC procedure is already in progress. This violates the 3GPP rule that prohibits starting a new N2 procedure while an SMC is ongoing.
SecurityMode in internal/gmm/sm.go: This function handles the NAS security mode procedure. It is vulnerable because it initiates the SMC procedure on EntryEvent without checking if an N2 handover is already in progress. This violates the 3GPP rule that prohibits initiating an SMC procedure while an N2 procedure is ongoing.

The concurrent execution of these two procedures can lead to a race condition, resulting in a mismatch of security keys (KAMF and KgNB) between the User Equipment (UE), the source gNB, and the target gNB. This mismatch can compromise the integrity of the communication channel and may lead to handover failures or other service disruptions. The vulnerability is a classic example of CWE-358: Improperly Implemented Security Check for Standard.

Vulnerable functions

handleHandoverRequiredMain

internal/ngap/handler.go

The function `handleHandoverRequiredMain` in `internal/ngap/handler.go` initiates an N2 handover procedure by calling `SetOnGoing` with `OnGoingProcedureN2Handover`. It does so without checking if a NAS Security Mode Command (SMC) procedure is already in progress. This violates rule 1 of 3GPP TS 33.501 §6.9.5.1, which prohibits initiating an N2 procedure with a new key while a NAS SMC procedure is ongoing. This can lead to a security context mismatch between the network and the UE.

SecurityMode

internal/gmm/sm.go

The `SecurityMode` function in `internal/gmm/sm.go` is responsible for handling the NAS Security Mode procedure. When the `EntryEvent` occurs, the function proceeds to send a Security Mode Command (SMC) without first verifying if an N2 handover procedure is already in progress. This violates rule 2 of 3GPP TS 33.501 §6.9.5.1, which states that an AMF shall not initiate a NAS SMC if an N2 procedure involving a new key is ongoing. This can cause a security context mismatch, as the new key from the SMC may conflict with the key used in the handover.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.