omec-project amf NGSetupRequest handler.go denial of service

published 2026-07-04 4 mo ago modified 2026-10-25 15 d ago also EUVD-2026-41663

cvss: 4.3; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.5%; EPSS 0.5% chance of exploitation in 30 days, percentile 45%
public exploits: 0; none known

A vulnerability was identified in omec-project amf up to 2.0.2/2.1.1. Impacted is an unknown function of the file /go/src/amf/ngap/handler.go of the component NGSetupRequest Handler. The manipulation leads to denial of service. It is possible to initiate the attack remotely. The exploit is publicly available and might be used. The identifier of the patch is 34bc6724acc97dba1f8691e586da95b042cb612d. To fix this issue, it is recommended to deploy a patch.

Patch / fix

links 2

github.com/omec-project/amf@34bc672 commit
github.com/omec-project/amf#666 pull request

CISA SSVC

Exploitation: Proof of concept is public
Automatable: no
Technical impact: partial
Assessed: 4 mo ago (2026-07-06)

Exploit prediction

0.55% chance of exploitation in the next 30 days, higher than 45% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

vuldb.com https://vuldb.com/submit/845349 referenced PoC, tagged "exploit" by a source, unverified
github.com https://github.com/omec-project/amf/issues/677 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
CNA	4.0	5.3	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P
CNA	3.1	4.3	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C
CNA	3.0	4.3	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C
CNA	2.0	4.0	AV:N/AC:L/Au:S/C:N/I:N/A:P/E:POC/RL:OF/RC:C
CNA	4.0	2.1	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CNA	3.1	4.3	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
CNA	2.0	4.0	AV:N/AC:L/Au:S/C:N/I:N/A:P

Affected products

omec-project amf

Classification

Weakness

CWE-404 Improper Resource Shutdown or Release

References

github.com /omec-project/amf/pull/666
issue-tracking, patch
github.com /omec-project/amf/commit/34bc6724acc97dba1f8691e586da95b042cb612d
patch
vuldb.com /submit/845349
third-party-advisory, exploit
github.com /omec-project/amf/issues/677
exploit, issue-tracking
vuldb.com /vuln/376140
vdb-entry
vuldb.com /vuln/376140/cti
signature, permissions-required
vuldb.com /cve/CVE-2026-14624
third-party-advisory
github.com /omec-project/amf/
product

Sources

CVE List CVE-2026-14624
NVD CVE-2026-14624

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary