id: GO-ID-PENDING
modules:
- module: github.com/omec-project/amf
non_go_versions:
- fixed: 2.2.0
vulnerable_at: 1.7.0
summary: AMF Vulnerable to Improper Resource Shutdown or Release in github.com/omec-project/amf
cves:
- CVE-2026-8781
ghsas:
- GHSA-4qf2-p32m-7hmf
references:
- advisory: https://github.com/advisories/GHSA-4qf2-p32m-7hmf
- advisory: https://nvd.nist.gov/vuln/detail/CVE-2026-8781
- fix: https://github.com/omec-project/amf/pull/666
- report: https://github.com/omec-project/amf/issues/673
- web: https://github.com/omec-project/amf
- web: https://github.com/omec-project/amf/releases/tag/v2.2.0
- web: https://vuldb.com/submit/811653
- web: https://vuldb.com/vuln/364405
- web: https://vuldb.com/vuln/364405/cti
source:
id: GHSA-4qf2-p32m-7hmf
created: 2026-06-24T21:52:33.617730603Z
review_status: UNREVIEWED
Advisory GHSA-4qf2-p32m-7hmf references a vulnerability in the following Go modules:
Description:
A security flaw has been discovered in omec-project amf up to 2.1.3-dev. The impacted element is the function RANConfiguration of the file ngap/handler.go. The manipulation results in null pointer dereference. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks. Upgrading to version 2.2.0 is sufficient to resolve this issue. Upgrading the affected component is recommended. The same pull request fixes multiple security issues.
References:
No existing reports found with this module or alias.
See doc/quickstart.md for instructions on how to triage this report.