Miggo at BlackHat 2026!
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/omec-project/amf | go | < 1.7.1-0.20260421213846-34bc6724acc9 | 1.7.1-0.20260421213846-34bc6724acc9 |
Miggo AIRoot Cause AnalysisThe vulnerability is a series of weaknesses in the handling of NGAP and NAS messages, where the AMF process can be crashed by sending malformed messages, leading to a Denial of Service. The root cause is insufficient validation of message contents, specifically checking for the presence of mandatory information elements (IEs) or validating their format before using them.
An attacker can craft messages that omit these IEs or provide them in an invalid format. When the vulnerable functions process such a message, they attempt to access data from a nil pointer or an out-of-bounds slice index, which causes the Go runtime to panic, crashing the AMF service.
The patch addresses this by adding numerous checks throughout the codebase to ensure that pointers are not nil and slices are not empty before they are accessed, and that data formats are valid.
The analysis identified several key functions that were vulnerable:
ngap.HandlePDUSessionResourceModifyIndication: This function, explicitly named in the vulnerability description, was missing checks for RANUENGAPID and PDUSessionResourceModifyIndicationList, leading to a nil pointer dereference.ngap.FetchRanUeContext: A central function for retrieving UE context, which was vulnerable to a nil pointer dereference when the RANUENGAPID was missing from an incoming message. Many message handlers call this function, making its impact widespread.gmm.HandleRegistrationRequest and gmm.HandleIdentityResponse: These functions were vulnerable to a panic caused by an out-of-bounds slice access when decoding a malformed SUCI (Subscription Concealed Identifier) containing an invalid PLMN ID.nas.FetchUeContextWithMobileIdentity: This function was vulnerable to a panic from an out-of-bounds slice access when processing a Deregistration Request with an empty Mobile Identity.Exploitation of any of these would result in the corresponding function name appearing in the stack trace of the crashed process. Therefore, these functions are critical indicators for detecting exploitation of this vulnerability.