Executive brief
The Access and Mobility Management Function (AMF) in the OMEC Project, which handles mobile network signaling, is vulnerable to a denial-of-service attack. An attacker can send a specially crafted network message containing invalid characters to crash the service. This would disrupt mobile connectivity and network operations for users relying on this component.
Technical details
A vulnerability in the NGAP Message Handler of the omec-project AMF (up to version 2.1.3-dev) allows for remote denial-of-service. The root cause is a failure to validate input strings in the 'ngap/dispatcher.go' and 'ngap/handler.go' components. Specifically, sending an NGSetupRequest containing a non-printable, non-UTF-8 string in the RANNodeName information element triggers a Go panic when the value is passed to the Prometheus metrics client. This leads to a service crash (memory corruption/panic). The issue is resolved in version 2.2.0 by implementing nil/empty checks and validating PLMN and NAS inputs.
Affected products
- omec-project amf < 2.2.0
Timeline
- 2026-04-21: patched: Pull request 666 merged to address crashes
- 2026-04-23: disclosed: Issue 670 reported with reproduction steps
- 2026-05-18: advisory: GHSA and CVE published