Executive brief
A vulnerability exists in the Access and Mobility Management Function (AMF) of the OMEC Project, a component used in 5G mobile core networks to manage device connectivity. An attacker can send specially crafted network messages that cause the system to crash due to memory corruption. This can lead to a denial of service, disrupting mobile network operations and connectivity for users.
Technical details
A memory corruption vulnerability (specifically a nil pointer dereference) exists in the omec-project amf package within the `PDUSessionResourceModifyIndication` function in `/go/src/amf/ngap/handler.go`. The flaw is triggered when a malformed NGAP message is received before an appropriate NG Context is established, leading to a service panic. An attacker with network access can exploit this to cause a Denial of Service (DoS). The issue has been addressed in version 1.7.1-0.20260421213846-34bc6724acc9 by adding nil/empty checks across the NGAP dispatcher and handlers to ensure malformed inputs are safely ignored.
Affected products
- omec-project amf < 1.7.1-0.20260421213846-34bc6724acc9
Timeline
- 2026-04-21: patched: Fix merged in pull request 666
- 2026-04-23: disclosed: Issue 681 opened describing the crash
- 2026-05-23: advisory: NVD published CVE-2026-9299
- 2026-05-26: advisory: GitHub Advisory published