Executive brief
A vulnerability exists in the Access and Mobility Management Function (AMF) of the omec-project, which is a core component of 5G mobile networks responsible for managing device connectivity and mobility. An attacker can send a specially crafted network request that causes the system to crash due to a memory handling error. This results in a denial-of-service condition, potentially disrupting mobile network services for users. The issue has been addressed in newer versions of the software.
Technical details
A vulnerability in the PathSwitchRequest Handler and NGAP dispatcher of omec-project amf (up to version 2.1.1) allows for remote memory corruption, specifically a nil pointer dereference. The root cause is a failure to validate the existence of a User Equipment (UE) Context before processing certain NGAP packets, such as a PathSwitchRequest. An attacker with network access can trigger a Go runtime panic (SIGSEGV) by sending malformed NGAP/NAS inputs, leading to a denial-of-service. The vulnerability is addressed in version 2.2.1 by implementing nil checks and input validation across the NGAP dispatcher and NAS security parsing components.
Affected products
- omec-project amf up to 2.1.1
Timeline
- 2026-04-21: patched: Pull request #666 merged to address crashes
- 2026-04-23: disclosed: Issue #680 reported with reproduction steps
- 2026-05-23: advisory: CVE-2026-9298 published