diff --git a/openair3/NAS/NR_UE/nr_nas_msg.c b/openair3/NAS/NR_UE/nr_nas_msg.c
index 5b23c4a041..e647857336 100644
--- a/openair3/NAS/NR_UE/nr_nas_msg.c
+++ b/openair3/NAS/NR_UE/nr_nas_msg.c
@@ -1134,6 +1134,12 @@ static void handle_security_mode_command(nr_ue_nas_t *nas, as_nas_info_t *initia
   /* todo: stream_security_container_delete() is not called anywhere, deal with that */
   nas->security_container = stream_security_container_init(ciphering_algorithm, integrity_algorithm, knas_enc, knas_int);
 
+  /* Handle the invalid container with a reject message */
+  if(nas->security_container == NULL) {
+    LOG_W(NAS, "Could not create security container!\n");
+    return;
+  }
+
   nas_itti_kgnb_refresh_req(nas->UE_id, nas->security.kgnb);
   generateSecurityModeComplete(nas, initialNasMsg);
 }
diff --git a/openair3/SECU/secu_defs.c b/openair3/SECU/secu_defs.c
index 17e3ca96ec..f8edf167df 100644
--- a/openair3/SECU/secu_defs.c
+++ b/openair3/SECU/secu_defs.c
@@ -118,6 +118,12 @@ stream_security_container_t *stream_security_container_init(int ciphering_algori
   container->integrity_context = stream_integrity_init(integrity_algorithm, integrity_key);
   container->ciphering_context = stream_ciphering_init(ciphering_algorithm, ciphering_key);
 
+  /* Reject invalid configurations, i.e. ones that set NIA0 */
+  if (container->integrity_context == NULL) {
+    stream_security_container_delete(container);
+    return NULL;
+  }
+
   return container;
 }