Low severity3.7GHSA Advisory· Published May 27, 2026· Updated May 28, 2026
CVE-2026-42082
CVE-2026-42082
Description
free5GC is an open-source implementation of the 5G core network. Prior to 4.2.2, the AMF in Free5GC does not enforce the concurrent security procedure rules defined in 3GPP TS 33.501 §6.9.5.1. The AMF does not check for ongoing N2 handover procedures before initiating a NAS Security Mode Command, and vice versa. This can lead to mismatches between NAS and AS security contexts in the network and the UE. This vulnerability is fixed in 4.2.2.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
github.com/free5gc/amfGo | <= 1.4.3 | — |
Affected products
2Patches
Vulnerability mechanics
References
3- github.com/free5gc/free5gc/security/advisories/GHSA-vrrx-58h3-prmhnvdExploitVendor AdvisoryWEB
- github.com/advisories/GHSA-vrrx-58h3-prmhghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2026-42082ghsaADVISORY
News mentions
1- Free5gc 4.2.2: 20 CVEs Land in Single Disclosure — Missing Auth, Panics, and Protocol FlawsVypr Intelligence · May 27, 2026