CVE-2026-14624: omec-project AMF DoS Vulnerability

CVE-2026-14624 Overview

CVE-2026-14624 affects the OMEC Project Access and Mobility Management Function (AMF) up to version 2.0.2/2.1.1. The vulnerability resides in the NGSetupRequest handler within /go/src/amf/ngap/handler.go and allows a remote authenticated attacker to trigger a denial of service condition. Malformed NG Application Protocol (NGAP) input causes the AMF process to crash, disrupting 5G core mobility management. A public exploit is referenced, and the maintainers released commit 34bc6724acc97dba1f8691e586da95b042cb612d to address the issue. The weakness is categorized under [CWE-404] Improper Resource Shutdown or Release.

Critical Impact
A remote attacker with low privileges can crash the AMF component by submitting a malformed NGSetupRequest, disrupting 5G subscriber registration and mobility management across the affected core network.

Affected Products

OMEC Project AMF version 2.0.2
OMEC Project AMF version 2.1.1
OMEC Project AMF versions prior to patch commit 34bc6724

Discovery Timeline

2026-07-04 - CVE-2026-14624 published to NVD
2026-07-06 - Last updated in NVD database

Technical Details for CVE-2026-14624

Vulnerability Analysis

The OMEC AMF implements the 5G control plane function responsible for user equipment (UE) registration, authentication signaling, and mobility management. The NGSetupRequest handler in ngap/handler.go processes the initial NGAP setup exchange between the gNodeB and AMF. The handler does not adequately validate all incoming NGAP fields before dereferencing structures further down the call chain. Related handling in gmm/handler.go propagates errors from decoded fields such as the Subscription Concealed Identifier (SUCI) without checking return values. When an attacker submits a crafted NGAP message with malformed identifiers, the AMF goroutine encounters an unhandled error path and terminates, producing a denial of service on the 5G core.

Root Cause

The root cause is improper resource shutdown and missing error handling on decoded NGAP fields [CWE-404]. Utility functions such as util.PlmnIdStringToModels returned an error value that was previously discarded. When these functions failed on malformed input, the AMF continued execution with invalid state and eventually crashed. The patch modifies callers to inspect the returned error and abort processing cleanly.

Attack Vector

An attacker with network access to the N2 interface between a gNodeB and the AMF can send a crafted NGSetupRequest containing malformed identifiers. Because the N2 interface is typically reachable from radio access network peers, any compromised or rogue gNB, or an adversary in the trusted transport network, can trigger the crash without any user interaction.

// Patch excerpt from gmm/handler.go — adds error handling on PLMN parsing
// Source: https://github.com/omec-project/amf/commit/34bc6724acc97dba1f8691e586da95b042cb612d
		if err != nil {
			return fmt.Errorf("decode SUCI failed: %w", err)
		}
-		ue.PlmnId = util.PlmnIdStringToModels(plmnId)
+		plmnID, err := util.PlmnIdStringToModels(plmnId)
+		if err != nil {
+			err = fmt.Errorf("invalid SUCI: %w", err)
+			ue.GmmLog.Errorln(err)
+			return err
+		}
+		ue.PlmnId = plmnID
		ue.GmmLog.Debugf("SUCI: %s", ue.Suci)
	case nasMessage.MobileIdentity5GSType5gGuti:
		guamiFromUeGutiTmp, guti := nasConvert.GutiToString(mobileIdentity5GSContents)

Source: GitHub Commit 34bc6724

Detection Methods for CVE-2026-14624

Indicators of Compromise

Unexpected AMF process restarts or panics in Go runtime logs referencing ngap/handler.go or gmm/handler.go.
Log entries containing decode SUCI failed or invalid SUCI immediately preceding a service interruption.
Repeated NGSetupRequest messages originating from a single gNB peer followed by loss of N2 sessions.

Detection Strategies

Monitor AMF container or pod restart counts in Kubernetes and correlate with N2 traffic bursts.
Deploy NGAP-aware inspection to flag NGSetupRequest messages with malformed PLMN or SUCI fields.
Alert on Go panic stack traces in centralized logging when the frame includes amf/ngap symbols.

Monitoring Recommendations

Ingest AMF stdout/stderr and structured logs into a SIEM and build detections for panic signatures.
Track N2 interface message rates per gNB peer to identify anomalous senders.
Monitor 5G registration success rates and alert on sudden drops that correlate with AMF availability events.

How to Mitigate CVE-2026-14624

Immediate Actions Required

Apply commit 34bc6724acc97dba1f8691e586da95b042cb612d from the OMEC AMF repository and rebuild the AMF container image.
Restrict N2 interface reachability to authenticated, known gNB peers using network segmentation and IPsec.
Enable AMF process supervision and automatic restart to reduce dwell time during an active exploitation attempt.

Patch Information

The fix is committed to the OMEC AMF repository as 34bc6724acc97dba1f8691e586da95b042cb612d and merged via Pull Request #666. The patch adds error propagation for identifier decoding paths in gmm/handler.go and hardens NGAP input handling. Operators should track the GitHub Issue #677 and upgrade beyond AMF 2.0.2 and 2.1.1 as soon as a tagged release incorporating the commit becomes available.

Workarounds

Enforce IPsec on the N2 interface and terminate connections from unauthenticated gNB peers before they reach the AMF.
Deploy rate limiting on NGAP setup messages at the transport layer to reduce crash amplification.
Run multiple AMF replicas behind an SCTP-aware load balancer so a single crash does not remove 5G registration availability.

bash

# Example: restrict N2 interface access with an nftables ruleset
nft add table inet amf_n2
nft add chain inet amf_n2 input { type filter hook input priority 0 \; }
nft add rule inet amf_n2 input ip saddr != { 10.10.0.0/24 } tcp dport 38412 drop
nft add rule inet amf_n2 input ip saddr != { 10.10.0.0/24 } sctp dport 38412 drop