omec-project amf Vulnerable to Improper Restriction of Operations within the Bounds of a Memory Buffer
Date: 2026-05
Affected: go/github.com/omec-project/amf
Attack vector: other
Category: vulnerability-disclosure
Severity: Low
CVE: CVE-2026-9299
CWE: CWE-119
CVSS: 6.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L)

A flaw has been found in omec-project amf up to 2.1.1. Affected by this issue is the function PDUSessionResourceModifyIndication of the file /go/src/amf/ngap/handler.go. This manipulation causes memory corruption. Remote exploitation of the attack is possible. The exploit has been published and may be used. Applying a patch is the recommended action to fix this issue.


Mitigations:

Architectural layers (MAESTRO):