CVE-2026-9301

A vulnerability was found in omec-project amf up to version 2.0.2/2.1.1 in the NGSetupRequest handler function within handler.go. Manipulation of this function allows a remote denial of service (DoS) attack.

A vulnerability was found in omec-project amf up to version 2.1.1 in the RRCInactiveTransitionReport function of the NGAP Message Handler. Remote manipulation can lead to denial of service (DoS). The exploit has been publicly disclosed and may be used.

In the omec-project amf up to version 2.1.1, a vulnerability was found in the NGSetupRequest Handler component that leads to memory corruption. The attack can be carried out remotely and the exploit has been disclosed.

In the omec-project amf up to version 2.1.1, a vulnerability was found in the PDUSessionResourceModifyIndication function of the file /go/src/amf/ngap/handler.go that leads to memory corruption. The attack can be carried out remotely and the exploit has been published.

A vulnerability was found in the PathSwitchRequest Handler component of omec-project amf up to version 2.1.1, leading to memory corruption. The attack can be launched remotely and the exploit is publicly available.

A security vulnerability was detected in omec-project amf up to 2.1.3-dev in the UERadioCapabilityCheckResponse function of the ngap/dispatcher.go file. Manipulation leads to a null pointer dereference, and the attack can be executed remotely. The exploit is publicly disclosed and upgrading to version 2.2.0 fixes the issue.

A weakness has been identified in omec-project amf up to 2.1.3-dev affecting an unknown function in ngap/handler.go of the NGAP Message Handler component. The manipulation causes a null pointer dereference. The exploit is publicly available and can be exploited remotely.

A security flaw has been discovered in omec-project amf up to 2.1.3-dev in the RANConfiguration function of ngap/handler.go. The manipulation results in a null pointer dereference. The attack can be launched remotely and the exploit has been publicly released.

A vulnerability was identified in omec-project amf up to 2.1.3-dev in an unknown function of ngap/dispatcher.go of the NGAP Message Handler component. The manipulation leads to memory corruption. The attack may be initiated remotely and the exploit is publicly available.

A vulnerability was determined in omec-project amf up to 2.1.3-dev in the NGSetupRequest function of ngap/handler.go. Manipulating the InformationElement argument can lead to memory corruption. The attack can be launched remotely and the exploit has been publicly disclosed.