Is CVE-2026-8781 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-8781 being exploited in the wild.

How severe is CVE-2026-8781?

Medium severity, with a CVSS score of 4.3, published 18 May 2026.

Which products and versions are affected?

github.com/omec-project/amf (Go) < 2.2.0, SEMVER:introduced=0, SEMVER:introduced=0,fixed=2.2.0; OMEC Project AMF <= 2.1.3-dev, up to 2.1.3-dev.

Is there a fix for CVE-2026-8781?

Yes. github.com/omec-project/amf (Go): upgrade to 2.2.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-8781 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-8781?

Check whether you run github.com/omec-project/amf (Go) or OMEC Project AMF at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-8781: omec-project amf null pointer dereference in RANConfiguration

Q: Is there a fix for CVE-2026-8781?

Yes. github.com/omec-project/amf (Go): upgrade to 2.2.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-8781 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-8781?

Check whether you run github.com/omec-project/amf (Go) or OMEC Project AMF at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-8781 · Severity: medium · CVSS 4.3 · Published 2026-05-18

The Access and Mobility Management Function (AMF) component of the Omec Project, which is used in 5G core networks to manage mobile device connectivity, is vulnerable to a remote crash. An attacker can send a specially crafted network message that causes the service to shut down unexpectedly. This results in a denial-of-service condition, potentially disrupting mobile network operations and connectivity for users.

Technologies: github.com/omec-project/amf (Go), OMEC Project AMF. Vendors: Go, OMEC Project.

Quick answers

Is CVE-2026-8781 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-8781 being exploited in the wild.
How severe is CVE-2026-8781?: Medium severity, with a CVSS score of 4.3, published 18 May 2026.
Which products and versions are affected?: github.com/omec-project/amf (Go) < 2.2.0, SEMVER:introduced=0, SEMVER:introduced=0,fixed=2.2.0; OMEC Project AMF <= 2.1.3-dev, up to 2.1.3-dev.
Is there a fix for CVE-2026-8781?: Yes. github.com/omec-project/amf (Go): upgrade to 2.2.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-8781 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-8781?: Check whether you run github.com/omec-project/amf (Go) or OMEC Project AMF at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/omec-project/amf (Go): upgrade to 2.2.0 or later
```
go get github.com/omec-project/amf@v2.2.0
```

Technical details

A null pointer dereference vulnerability exists in the omec-project/amf Go package within the `HandleRanConfigurationUpdate` function in `ngap/handler.go`. The flaw is triggered when the AMF receives a malformed NGAP (Next Generation Application Protocol) message, specifically a `RANConfigurationUpdate` that lacks expected Information Elements (IEs). Because the code fails to validate the presence of these fields before access, it triggers a Go runtime panic (SIGSEGV). An attacker with network access to the AMF's NGAP interface can exploit this to crash the service. The issue is addressed in version 2.2.0 by implementing comprehensive nil-pointer and bounds checks across the NGAP dispatcher and handlers.

Affected products

omec-project amf <= 2.1.3-dev

Identifiers

CVE-2026-8781
GHSA-4qf2-p32m-7hmf
GO-2026-5130

Timeline

2026-04-21: patched: Pull request 666 merged to address crashes
2026-04-23: disclosed: Issue 673 reported with reproduction steps
2026-05-18: advisory: GitHub Advisory and CVE published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.