Miggo at BlackHat 2026!
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability is a series of improper input validation issues within the omec-project/amf service, leading to crashes (denial of service) when processing malformed NGAP messages. The root cause is a widespread lack of nil-checking and bounds-checking on data extracted from incoming network packets before it is used.
The advisory specifically mentions the NGSetupRequest Handler, and the analysis confirms a nil pointer dereference vulnerability in the ngap.HandleNGSetupRequest function. If the SupportedTAList IE is missing from the request, the program would crash.
However, the provided patch addresses a much broader set of similar vulnerabilities across the codebase. The commit fixes numerous instances where the application could crash due to malformed input. This includes:
ngap package (e.g., HandleNGReset, HandleHandoverNotify, HandleLocationReport) were patched to add checks for nil pointers on optional Information Elements (IEs) from NGAP messages before accessing them.util.PlmnIdStringToModels and nas_security.FetchUeContextWithMobileIdentity were patched to validate the length of slices or strings before accessing elements by index or creating substrings. A failure to do so would cause a panic.An attacker could craft and send specific NGAP messages with missing or malformed IEs to remotely trigger these panics, resulting in a denial of service for the AMF. The identified vulnerable functions are the primary entry points for processing these malicious messages.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/omec-project/amf | go | < 1.7.1-0.20260421213846-34bc6724acc9 | 1.7.1-0.20260421213846-34bc6724acc9 |