Executive brief
The Access and Mobility Management Function (AMF) component of the omec-project, which manages mobile network connections, is vulnerable to a denial-of-service attack. An attacker can send specially crafted network messages that cause the service to crash. This results in a loss of availability for mobile network management operations until the service is restarted.
Technical details
A null pointer dereference vulnerability exists in the NGAP (Next Generation Application Protocol) message handler of the omec-project AMF. Specifically, the `HandleLocationReportingFailureIndication` function in `ngap/handler.go` fails to properly validate malformed NGAP messages, such as those with missing or invalid Information Elements (IEs). A remote attacker with network access to the AMF can send a crafted `LocationReportFailureIndication` message to trigger a panic (SIGSEGV), leading to a denial-of-service (DoS) condition. This issue was addressed in version 2.2.0 by implementing comprehensive nil-pointer checks and input validation across the NGAP dispatcher and NAS security parsing components.
Affected products
- omec-project amf < 2.2.0
Timeline
- 2026-04-21: patched: Pull request 666 merged to address crashes
- 2026-04-23: other: Issue 674 opened with reproduction steps
- 2026-05-18: advisory: GHSA and CVE published