CVE-2026-14623: OMEC Project AMF DoS Vulnerability

CVE-2026-14623 Overview

CVE-2026-14623 is a denial of service vulnerability in the omec-project Access and Mobility Management Function (AMF) through version 2.1.1. The flaw resides in the RRCInactiveTransitionReport function within the NGAP (Next Generation Application Protocol) Message Handler. A remote authenticated attacker can send a manipulated NGAP message to trigger a crash in the AMF service. The exploit has been publicly disclosed. The maintainers issued patch commit 34bc6724acc97dba1f8691e586da95b042cb612d to remediate the issue. This vulnerability is tracked under [CWE-404] (Improper Resource Shutdown or Release).

Critical Impact
A remote attacker with low privileges can crash the AMF component, disrupting 5G core network availability for connected user equipment.

Affected Products

omec-project AMF versions up to and including 2.1.1
5G core deployments using the OMEC AMF NGAP Message Handler
Downstream distributions bundling the affected AMF component

Discovery Timeline

2026-07-04 - CVE-2026-14623 published to NVD
2026-07-06 - Last updated in NVD database

Technical Details for CVE-2026-14623

Vulnerability Analysis

The omec-project AMF is a Go-based implementation of the 5G Access and Mobility Management Function. The AMF terminates NGAP signaling from the gNodeB over the N2 interface. The RRCInactiveTransitionReport handler processes Radio Resource Control (RRC) state transition reports sent by the RAN.

The handler fails to validate malformed input before dereferencing internal fields. When the AMF receives a crafted NGAP message, parsing errors propagate without proper resource cleanup or safe error return. This condition allows an attacker with signaling access to force the AMF process into an unrecoverable state. The result is a denial of service against the 5G core control plane.

Root Cause

The root cause is improper resource shutdown or release [CWE-404] combined with missing input validation in NGAP message parsing paths. Helper routines such as PlmnIdStringToModels returned unchecked values, and callers used those values without verifying success. Malformed identifiers propagated into downstream logic and caused runtime panics.

Attack Vector

Exploitation requires network reachability to the AMF N2 interface and the ability to send NGAP messages. An attacker positioned on the signaling plane, such as a compromised gNodeB or an adjacent node with N2 connectivity, can transmit a crafted RRCInactiveTransitionReport payload. Successful exploitation terminates the AMF process, disconnecting attached user equipment and blocking new registrations.

// Patch excerpt from gmm/handler.go (commit 34bc6724acc97dba1f8691e586da95b042cb612d)
// Address multiple cases of crashes due to malformed NGAP input (#666)

		if err != nil {
			return fmt.Errorf("decode SUCI failed: %w", err)
		}
-		ue.PlmnId = util.PlmnIdStringToModels(plmnId)
+		plmnID, err := util.PlmnIdStringToModels(plmnId)
+		if err != nil {
+			err = fmt.Errorf("invalid SUCI: %w", err)
+			ue.GmmLog.Errorln(err)
+			return err
+		}
+		ue.PlmnId = plmnID
		ue.GmmLog.Debugf("SUCI: %s", ue.Suci)
	case nasMessage.MobileIdentity5GSType5gGuti:
		guamiFromUeGutiTmp, guti := nasConvert.GutiToString(mobileIdentity5GSContents)

Source: GitHub Commit 34bc6724acc97dba1f8691e586da95b042cb612d

The patch converts PlmnIdStringToModels into an error-returning function and requires callers to handle invalid identifiers explicitly rather than propagating a bad value.

Detection Methods for CVE-2026-14623

Indicators of Compromise

Unexpected AMF process termination or panic traces referencing RRCInactiveTransitionReport or PlmnIdStringToModels
Sudden loss of N2 associations from multiple gNodeBs followed by mass UE re-registrations
NGAP messages containing malformed SUCI or PLMN identifier fields recorded at the N2 ingress

Detection Strategies

Monitor AMF container logs for Go runtime panics and stack traces originating in gmm/handler.go
Correlate crash events with inbound NGAP RRCInactiveTransitionReport messages using packet capture on the N2 interface
Baseline normal NGAP message rates and flag deviations that coincide with AMF restarts

Monitoring Recommendations

Enable structured logging on the AMF and forward GmmLog output to a centralized log platform for pattern matching
Track Kubernetes pod restart counts and liveness probe failures for AMF workloads in 5G core deployments
Alert on repeated NGAP decode errors from the same source gNodeB identifier

How to Mitigate CVE-2026-14623

Immediate Actions Required

Upgrade omec-project AMF to a build that includes commit 34bc6724acc97dba1f8691e586da95b042cb612d or a later release beyond 2.1.1
Restrict N2 interface reachability to trusted gNodeB endpoints using network segmentation and mutual TLS or IPsec
Review AMF crash history and confirm whether prior restarts correlate with malformed NGAP traffic

Patch Information

The upstream fix is available in the omec-project AMF repository as commit 34bc6724acc97dba1f8691e586da95b042cb612d, merged via pull request #666. The issue is tracked in GitHub Issue #676. Operators should rebuild container images from a patched source tree and redeploy affected AMF instances. Additional context is available in the VulDB CVE Report.

Workarounds

Enforce strict N2 access control lists to limit which RAN nodes can initiate NGAP sessions with the AMF
Deploy redundant AMF instances behind a load balancer so that a single crash does not disable the control plane
Apply rate limiting on NGAP signaling and drop malformed messages at an upstream security gateway where feasible

bash

# Example: rebuild and redeploy patched AMF container
git clone https://github.com/omec-project/amf.git
cd amf
git checkout 34bc6724acc97dba1f8691e586da95b042cb612d
docker build -t omec-amf:patched-cve-2026-14623 .
kubectl set image deployment/amf amf=omec-amf:patched-cve-2026-14623 -n omec
kubectl rollout status deployment/amf -n omec