Executive brief
The Access and Mobility Management Function (AMF) in the omec-project, a core component of 5G mobile networks, is vulnerable to a remote crash. An attacker can send a specially crafted network message that causes the service to stop responding. This results in a denial-of-service condition, potentially disrupting mobile connectivity for users relying on the affected network infrastructure.
Technical details
A null pointer dereference exists in the omec-project AMF (Access and Mobility Management Function) within the UERadioCapabilityCheckResponse function in ngap/dispatcher.go. The vulnerability is triggered when the NGAP dispatcher fails to properly validate malformed or incomplete NGAP PDUs, leading to a panic during message handling. A remote attacker with the ability to send NGAP messages to the AMF can exploit this to cause a denial-of-service (DoS) by crashing the service. The issue was addressed in version 2.2.0 by implementing comprehensive nil-pointer and bounds checks across the NGAP and NAS handlers.
Affected products
- omec-project amf < 2.2.0
Timeline
- 2026-04-21: patched: Fix merged in pull request 666
- 2026-04-23: disclosed: Public issue report with reproduction steps published
- 2026-05-18: advisory: GitHub Advisory and CVE published