2.1

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-9301

CVE-2026-9301: omec-project amf Vulnerable to Improper Restriction of Operations within the Bounds of a Memory Buffer

A vulnerability was found in omec-project amf up to 2.1.1. This vulnerability affects unknown code of the component NGReset Message Handler. Performing a manipulation results in memory corruption. The attack is possible to be carried out remotely. The exploit has been made public and could be used. It is recommended to apply a patch to fix this issue.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-9301

CVE-2026-9301:

2.1

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation pocAutomatable NoTech Impact Partial

Select your environment

→SSVCDeferfix on upgrade

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/omec-project/amf	go	< 1.7.1-0.20260421213846-34bc6724acc9	1.7.1-0.20260421213846-34bc6724acc9

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability, described as 'Improper Restriction of Operations within the Bounds of a Memory Buffer' in the 'NGReset Message Handler', is caused by insufficient validation of input from NGAP and NAS messages. The provided patch addresses multiple instances of this issue across the codebase.

The analysis of the patch 34bc6724acc97dba1f8691e586da95b042cb612d reveals several key vulnerable functions:

ngap.HandleNGReset: The vulnerability description explicitly mentions the 'NGReset Message Handler'. The patch confirms a flaw where the code could attempt to dereference a nil pointer if a UE context was not found, leading to a crash. This is a classic denial-of-service vulnerability triggerable by a malformed NGReset message.
util.PlmnIdStringToModels: This function had a critical flaw where it did not validate the length of its input string before slicing it. An input string shorter than 3 characters would cause an out-of-bounds read and a panic. This is a direct example of the 'Improper Restriction of Operations within the Bounds of a Memory Buffer' (CWE-119) mentioned.
gmm.HandleRegistrationRequest and gmm.HandleIdentityResponse: These functions were vulnerable because they used the flawed util.PlmnIdStringToModels function to parse data from incoming messages. A malformed SUCI in either a registration request or an identity response could trigger the panic in the utility function, crashing the service.
nas_security.FetchUeContextWithMobileIdentity: This function was vulnerable to an out-of-bounds read when processing a deregistration request. It accessed the first element of a slice without checking if the slice was empty, which could be caused by a malformed message.

In all these cases, a remote attacker could craft a malicious NGAP or NAS message to trigger a panic, resulting in a denial of service of the AMF component. The patch mitigates these issues by adding the necessary nil checks and input validation to prevent crashes.

Vulnerable functions

gmm.HandleRegistrationRequest

gmm/handler.go

The function calls `util.PlmnIdStringToModels` to parse a PLMN ID from a SUCI in a registration request. The original implementation of `PlmnIdStringToModels` was vulnerable to an out-of-bounds read if the input string was too short, causing a panic. A remote attacker could send a malformed registration request to crash the AMF service.

gmm.HandleIdentityResponse

gmm/handler.go

The function calls `util.PlmnIdStringToModels` to parse a PLMN ID from a SUCI in an identity response message. The original implementation of `PlmnIdStringToModels` was vulnerable to an out-of-bounds read if the input string was too short, causing a panic. A remote attacker could send a malformed identity response to crash the AMF service.

nas_security.FetchUeContextWithMobileIdentity

nas/nas_security/security.go

The function retrieves the `MobileIdentity5GSContents` from a deregistration request and attempts to access the first element `mobileIdentity5GSContents[0]` without checking if the slice is empty. A malformed message with an empty identity field would cause an out-of-bounds read, leading to a panic and a denial of service.

ngap.HandleNGReset

ngap/handler.go

When processing an NGReset message, the code iterates through a list of UEs. If a UE context (`ranUe`) could not be found based on the information in the message, the `ranUe` variable would be `nil`. The original code did not handle this case and would proceed to call the `Remove()` method on the `nil` pointer, causing a panic and crashing the service. The vulnerability is in the NGReset message handler, which can be triggered by a remote attacker.

util.PlmnIdStringToModels

util/convert.go

The function was vulnerable to an out-of-bounds read. It did not validate the length of the input string `plmnId` before performing a slice operation `plmnId[:3]`. If the input string had fewer than 3 characters, this operation would cause a panic. This function is called by other handlers processing NAS messages, making them vulnerable as well.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.