Is CVE-2026-8349 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-8349 being exploited in the wild.

How severe is CVE-2026-8349?

Medium severity, with a CVSS score of 4.3, published 12 May 2026.

Which products and versions are affected?

github.com/omec-project/amf (Go) <= 1.7.0, SEMVER:introduced=0, SEMVER:introduced=0,last_affected=1.7.0; OMEC Project AMF <= 2.1.1, up to 2.1.1.

Is there a fix for CVE-2026-8349?

A patch was published on 2026-04-21: Pull request 666 merged to address crashes Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-8349 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-8349?

Check whether you run github.com/omec-project/amf (Go) or OMEC Project AMF at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-8349: omec-project AMF denial of service in NGAP Message Handler

Q: Is there a fix for CVE-2026-8349?

A patch was published on 2026-04-21: Pull request 666 merged to address crashes Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-8349 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-8349?

Check whether you run github.com/omec-project/amf (Go) or OMEC Project AMF at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-8349 · Severity: medium · CVSS 4.3 · Published 2026-05-12

The omec-project Access and Mobility Management Function (AMF), a core component of 5G mobile networks, is vulnerable to a remote crash. An attacker can send a specially crafted location report message that causes the service to fail due to a memory error. This results in a denial-of-service condition, potentially disrupting mobile connectivity for users managed by the affected network node.

Technologies: github.com/omec-project/amf (Go), OMEC Project AMF. Vendors: Go, OMEC Project.

Quick answers

Is CVE-2026-8349 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-8349 being exploited in the wild.
How severe is CVE-2026-8349?: Medium severity, with a CVSS score of 4.3, published 12 May 2026.
Which products and versions are affected?: github.com/omec-project/amf (Go) <= 1.7.0, SEMVER:introduced=0, SEMVER:introduced=0,last_affected=1.7.0; OMEC Project AMF <= 2.1.1, up to 2.1.1.
Is there a fix for CVE-2026-8349?: A patch was published on 2026-04-21: Pull request 666 merged to address crashes Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-8349 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-8349?: Check whether you run github.com/omec-project/amf (Go) or OMEC Project AMF at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A vulnerability in the NGAP Message Handler of omec-project amf (up to version 2.1.1) allows for a remote denial-of-service. The flaw is rooted in a nil pointer dereference within the `HandleLocationReport` function in `ngap/handler.go`. An attacker with network access can trigger a panic by sending a malformed NGAP LocationReport message containing unexpected or missing protocol Information Elements (IEs). This leads to memory corruption/segmentation violation, crashing the AMF process. The issue has been addressed in version 2.2.0 and later by implementing comprehensive nil checks and input validation across the NGAP dispatcher and handlers.

Affected products

omec-project amf <= 2.1.1

Identifiers

CVE-2026-8349
GHSA-3h63-fx68-x5fm
GO-2026-5087

Timeline

2026-04-21: patched: Pull request 666 merged to address crashes
2026-04-23: disclosed: Issue 672 opened with reproduction steps
2026-05-12: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.