Is CVE-2026-9299 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-9299 being exploited in the wild.

How severe is CVE-2026-9299?

Medium severity, with a CVSS score of 6.3, published 23 May 2026.

Which products and versions are affected?

github.com/omec-project/amf (Go) < 1.7.1-0.20260421213846-34bc6724acc9, SEMVER:introduced=0,fixed=1.7.1-0.20260421213846-34bc6724acc9; OMEC Project AMF < 1.7.1-0.20260421213846-34bc6724acc9, up to 2.1.1.

Is there a fix for CVE-2026-9299?

Yes. github.com/omec-project/amf (Go): upgrade to 1.7.1-0.20260421213846-34bc6724acc9 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-9299 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-9299?

Check whether you run github.com/omec-project/amf (Go) or OMEC Project AMF at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-9299: omec-project amf nil pointer dereference in PDUSessionResourceModifyIndication

Q: Is there a fix for CVE-2026-9299?

Yes. github.com/omec-project/amf (Go): upgrade to 1.7.1-0.20260421213846-34bc6724acc9 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-9299 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-9299?

Check whether you run github.com/omec-project/amf (Go) or OMEC Project AMF at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-9299 · Severity: medium · CVSS 6.3 · Published 2026-05-23

A vulnerability exists in the Access and Mobility Management Function (AMF) of the OMEC Project, a component used in 5G mobile core networks to manage device connectivity. An attacker can send specially crafted network messages that cause the system to crash due to memory corruption. This can lead to a denial of service, disrupting mobile network operations and connectivity for users.

Technologies: github.com/omec-project/amf (Go), OMEC Project AMF. Vendors: Go, OMEC Project.

Quick answers

Is CVE-2026-9299 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-9299 being exploited in the wild.
How severe is CVE-2026-9299?: Medium severity, with a CVSS score of 6.3, published 23 May 2026.
Which products and versions are affected?: github.com/omec-project/amf (Go) < 1.7.1-0.20260421213846-34bc6724acc9, SEMVER:introduced=0,fixed=1.7.1-0.20260421213846-34bc6724acc9; OMEC Project AMF < 1.7.1-0.20260421213846-34bc6724acc9, up to 2.1.1.
Is there a fix for CVE-2026-9299?: Yes. github.com/omec-project/amf (Go): upgrade to 1.7.1-0.20260421213846-34bc6724acc9 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-9299 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-9299?: Check whether you run github.com/omec-project/amf (Go) or OMEC Project AMF at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/omec-project/amf (Go): upgrade to 1.7.1-0.20260421213846-34bc6724acc9 or later
```
go get github.com/omec-project/amf@v1.7.1-0.20260421213846-34bc6724acc9
```

Technical details

A memory corruption vulnerability (specifically a nil pointer dereference) exists in the omec-project amf package within the `PDUSessionResourceModifyIndication` function in `/go/src/amf/ngap/handler.go`. The flaw is triggered when a malformed NGAP message is received before an appropriate NG Context is established, leading to a service panic. An attacker with network access can exploit this to cause a Denial of Service (DoS). The issue has been addressed in version 1.7.1-0.20260421213846-34bc6724acc9 by adding nil/empty checks across the NGAP dispatcher and handlers to ensure malformed inputs are safely ignored.

Affected products

omec-project amf < 1.7.1-0.20260421213846-34bc6724acc9

Identifiers

CVE-2026-9299
GHSA-m9r6-r5c3-jw4j
GO-2026-5843

Timeline

2026-04-21: patched: Fix merged in pull request 666
2026-04-23: disclosed: Issue 681 opened describing the crash
2026-05-23: advisory: NVD published CVE-2026-9299
2026-05-26: advisory: GitHub Advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.