CVE-2026-8781: OMEC Project AMF DoS Vulnerability

CVE-2026-8781 Overview

CVE-2026-8781 is a null pointer dereference vulnerability in the omec-project Access and Mobility Management Function (AMF) component, affecting versions up to 2.1.3-dev. The flaw resides in the RANConfiguration function within ngap/handler.go. An authenticated remote attacker can trigger the dereference by sending crafted NGAP messages, causing the AMF process to crash. A public exploit has been released. The issue is classified under CWE-404 (Improper Resource Shutdown or Release) and is resolved in version 2.2.0.

Critical Impact
A remote, low-privileged attacker can crash the AMF service, disrupting 5G core mobility management and degrading availability across connected radio access network nodes.

Affected Products

omec-project AMF versions up to and including 2.1.3-dev
5G core deployments using the affected ngap/handler.goRANConfiguration function
Open Mobile Evolved Core (OMEC) 5G core network deployments

Discovery Timeline

2026-05-18 - CVE-2026-8781 published to NVD
2026-05-18 - Last updated in NVD database
omec-project AMF v2.2.0 - Patch released via GitHub Pull Request #666

Technical Details for CVE-2026-8781

Vulnerability Analysis

The vulnerability resides in the RANConfiguration function in ngap/handler.go, part of the omec-project AMF. The AMF processes NG Application Protocol (NGAP) messages exchanged with gNodeB radio access network nodes. When parsing a specific RAN configuration message, the handler dereferences a pointer without validating that the referenced object was successfully initialized. An attacker sending a malformed or unexpected NGAP message triggers the null dereference. The result is an immediate process crash, terminating active sessions and disrupting mobility management. Because the AMF is a central control-plane function in 5G core networks, an outage cascades to subscriber registration, handover, and session continuity.

Root Cause

The defect maps to CWE-404, reflecting improper handling of resources during NGAP message processing. The RANConfiguration handler does not validate that internal data structures are non-nil before invoking methods or accessing fields on them. Go runtime semantics convert such an access into a panic, which propagates and terminates the AMF process unless recovered. See the GitHub Issue #673 and Pull Request #666 for the maintainer's analysis and remediation.

Attack Vector

Exploitation requires network reachability to the AMF NGAP interface and low-level privileges sufficient to deliver an NGAP message. A compromised or malicious gNodeB, or any attacker able to interpose on the N2 interface, can submit a crafted RAN configuration message to invoke the vulnerable path. User interaction is not required. A public proof-of-concept is referenced in the VulDB entry #364405.

No verified exploit code is available for inclusion. Refer to the omec-project AMF repository for the patched implementation.

Detection Methods for CVE-2026-8781

Indicators of Compromise

Unexpected AMF process crashes or panics referencing ngap/handler.go and the RANConfiguration function in service logs.
Repeated NGAP session resets or N2 interface re-establishment events from one or more gNodeB peers.
Sudden drops in registered UE counts coinciding with malformed NGAP message receipts.

Detection Strategies

Monitor AMF container logs for Go runtime panic traces containing nil pointer dereference and stack frames within ngap package handlers.
Inspect NGAP traffic for malformed RANConfiguration or RAN configuration update messages with missing or invalid information elements.
Correlate AMF restart events with upstream gNodeB connections to identify the source peer triggering the fault.

Monitoring Recommendations

Alert on AMF pod or process restart frequency exceeding baseline within Kubernetes or systemd telemetry.
Capture NGAP packet traces at the N2 interface for forensic review when crashes occur.
Track the running AMF version across the cluster to confirm that all instances are on 2.2.0 or later.

How to Mitigate CVE-2026-8781

Immediate Actions Required

Upgrade omec-project AMF to version 2.2.0 or later as published in the v2.2.0 release.
Restrict N2 interface access to authenticated, trusted gNodeB peers using network segmentation and firewall rules.
Review AMF deployment manifests and container images to confirm no pinned references to vulnerable 2.1.3-dev or earlier builds remain.

Patch Information

The maintainers resolved the issue in omec-project AMF v2.2.0. The fix is included in Pull Request #666, which addresses multiple related security issues including the null pointer dereference in the RANConfiguration handler. Operators should rebuild and redeploy AMF container images from the tagged release.

Workarounds

Apply strict access controls on the N2 SCTP interface to permit only known gNodeB IP addresses.
Deploy AMF instances behind a network policy that filters unexpected NGAP message types until patching completes.
Enable automated AMF pod restart and health checks to limit downtime if the crash is triggered before upgrade.

bash

# Configuration example: pin omec-project AMF to the patched release
# Update Helm chart or Kubernetes manifest image tag
image:
  repository: omecproject/amf
  tag: "v2.2.0"

# Verify deployed version after rollout
kubectl get pods -n omec -l app=amf -o jsonpath='{.items[*].spec.containers[*].image}'