id: GO-ID-PENDING
modules:
- module: github.com/omec-project/amf
non_go_versions:
- fixed: 2.2.0
vulnerable_at: 1.7.0
summary: AMF Improperly Restricts Operations within the Bounds of a Memory Buffer in github.com/omec-project/amf
cves:
- CVE-2026-8779
ghsas:
- GHSA-fxvj-wqv2-xgcq
references:
- advisory: https://github.com/advisories/GHSA-fxvj-wqv2-xgcq
- advisory: https://nvd.nist.gov/vuln/detail/CVE-2026-8779
- fix: https://github.com/omec-project/amf/pull/666
- report: https://github.com/omec-project/amf/issues/671
- web: https://github.com/omec-project/amf
- web: https://github.com/omec-project/amf/releases/tag/v2.2.0
- web: https://vuldb.com/submit/811616
- web: https://vuldb.com/vuln/364403
- web: https://vuldb.com/vuln/364403/cti
source:
id: GHSA-fxvj-wqv2-xgcq
created: 2026-06-25T00:05:38.301863594Z
review_status: UNREVIEWED
Advisory GHSA-fxvj-wqv2-xgcq references a vulnerability in the following Go modules:
Description:
A vulnerability was determined in omec-project amf up to 2.1.3-dev. Impacted is the function NGSetupRequest of the file ngap/handler.go. Executing a manipulation of the argument InformationElement can lead to memory corruption. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. Upgrading to version 2.2.0 is recommended to address this issue. The affected component should be upgraded. The same pull request fixes multiple security issues.
References:
No existing reports found with this module or alias.
See doc/quickstart.md for instructions on how to triage this report.