CVE-2026-14624
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk24th percentile - higher than 24% of all known CVEs
Summary
A vulnerability was found in omec-project amf up to version 2.0.2/2.1.1 in the NGSetupRequest handler function within handler.go. Manipulation of this function allows a remote denial of service (DoS) attack.
Risk Assessment
The attack can cause unavailability of AMF network services, disrupting the entire 5G infrastructure and affecting end users.
Recommendation
Apply the patch identified by 34bc6724acc97dba1f8691e586da95b042cb612d immediately and upgrade to a version beyond 2.1.1.
Other vulnerabilities in omec-project amf
See all- CVE-2026-14623Medium
A vulnerability was found in omec-project amf up to version 2.1.1 in the RRCInactiveTransitionReport function of the NGAP Message Handler. Remote manipulation can lead to denial of service (DoS). The exploit has been publicly disclosed and may be used.
- CVE-2026-9301Medium
In the omec-project amf up to version 2.1.1, a vulnerability was found in the NGReset Message Handler component that leads to memory corruption. The attack can be carried out remotely and the exploit has been published.
- CVE-2026-9300Medium
In the omec-project amf up to version 2.1.1, a vulnerability was found in the NGSetupRequest Handler component that leads to memory corruption. The attack can be carried out remotely and the exploit has been disclosed.
- CVE-2026-9299Medium
In the omec-project amf up to version 2.1.1, a vulnerability was found in the PDUSessionResourceModifyIndication function of the file /go/src/amf/ngap/handler.go that leads to memory corruption. The attack can be carried out remotely and the exploit has been published.
- CVE-2026-9298Medium
A vulnerability was found in the PathSwitchRequest Handler component of omec-project amf up to version 2.1.1, leading to memory corruption. The attack can be launched remotely and the exploit is publicly available.
Original NVD description (English source)
A vulnerability was identified in omec-project amf up to 2.0.2/2.1.1. Impacted is an unknown function of the file /go/src/amf/ngap/handler.go of the component NGSetupRequest Handler. The manipulation leads to denial of service. It is possible to initiate the attack remotely. The exploit is publicly available and might be used. The identifier of the patch is 34bc6724acc97dba1f8691e586da95b042cb612d. To fix this issue, it is recommended to deploy a patch.