# CVE-2026-9299: omec-project amf nil pointer dereference in PDUSessionResourceModifyIndication

Source: https://junglewise.ai/threats/cve-2026-9299-omec-project-amf-nil-pointer-dereference-in  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-23. Updated: 2026-06-30  
License: CC BY 4.0 with a link back

CVE-2026-9299 · Severity: medium · CVSS 6.3 · Published 2026-05-23

A vulnerability exists in the Access and Mobility Management Function (AMF) of the OMEC Project, a component used in 5G mobile core networks to manage device connectivity. An attacker can send specially crafted network messages that cause the system to crash due to memory corruption. This can lead to a denial of service, disrupting mobile network operations and connectivity for users.

Technologies: [github.com/omec-project/amf (Go)](https://junglewise.ai/threats/technologies/github-com-omec-project-amf), [OMEC Project AMF](https://junglewise.ai/threats/technologies/amf). Vendors: [Go](https://junglewise.ai/threats/vendors/go), [OMEC Project](https://junglewise.ai/threats/vendors/omec-project).

## Quick answers

**Is CVE-2026-9299 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-9299 being exploited in the wild.

**How severe is CVE-2026-9299?** Medium severity, with a CVSS score of 6.3, published 23 May 2026.

**Which products and versions are affected?** github.com/omec-project/amf (Go) < 1.7.1-0.20260421213846-34bc6724acc9, SEMVER:introduced=0,fixed=1.7.1-0.20260421213846-34bc6724acc9; OMEC Project AMF < 1.7.1-0.20260421213846-34bc6724acc9, up to 2.1.1.

**Is there a fix for CVE-2026-9299?** Yes. github.com/omec-project/amf (Go): upgrade to 1.7.1-0.20260421213846-34bc6724acc9 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-9299 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-9299?** Check whether you run github.com/omec-project/amf (Go) or OMEC Project AMF at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/omec-project/amf (Go): upgrade to 1.7.1-0.20260421213846-34bc6724acc9 or later

  ```sh
  go get github.com/omec-project/amf@v1.7.1-0.20260421213846-34bc6724acc9
  ```


## Technical details

A memory corruption vulnerability (specifically a nil pointer dereference) exists in the omec-project amf package within the `PDUSessionResourceModifyIndication` function in `/go/src/amf/ngap/handler.go`. The flaw is triggered when a malformed NGAP message is received before an appropriate NG Context is established, leading to a service panic. An attacker with network access can exploit this to cause a Denial of Service (DoS). The issue has been addressed in version 1.7.1-0.20260421213846-34bc6724acc9 by adding nil/empty checks across the NGAP dispatcher and handlers to ensure malformed inputs are safely ignored.

## Affected products

- omec-project amf < 1.7.1-0.20260421213846-34bc6724acc9

## Identifiers

- CVE-2026-9299
- GHSA-m9r6-r5c3-jw4j
- GO-2026-5843

## Timeline

- 2026-04-21: patched: Fix merged in pull request 666
- 2026-04-23: disclosed: Issue 681 opened describing the crash
- 2026-05-23: advisory: NVD published CVE-2026-9299
- 2026-05-26: advisory: GitHub Advisory published

## References

- [https://github.com/omec-project/amf/issues/681](https://github.com/omec-project/amf/issues/681)
- [https://github.com/omec-project/amf/pull/666](https://github.com/omec-project/amf/pull/666)
- [https://github.com/omec-project/amf](https://github.com/omec-project/amf)
- [https://vuldb.com/submit/811829](https://vuldb.com/submit/811829)
- [https://vuldb.com/vuln/365246](https://vuldb.com/vuln/365246)

## Related threats

- [omec-project amf denial of service in NGAP handler](https://junglewise.ai/threats/cve-2026-14624-omec-project-amf-denial-of-service-in-ngap-handler)
- [omec-project amf denial of service in NGAP Message Handler](https://junglewise.ai/threats/cve-2026-14623-omec-project-amf-denial-of-service-in-ngap-message-handler)
- [omec-project amf memory corruption in NGReset Message Handler](https://junglewise.ai/threats/cve-2026-9301-omec-project-amf-memory-corruption-in-ngreset-message-handler)
- [omec-project amf memory corruption in NGSetupRequest Handler](https://junglewise.ai/threats/cve-2026-9300-omec-project-amf-memory-corruption-in-ngsetuprequest-handler)
- [omec-project amf memory corruption in PathSwitchRequest Handler](https://junglewise.ai/threats/cve-2026-9298-omec-project-amf-memory-corruption-in-pathswitchrequest-handler)