id: GO-ID-PENDING
modules:
- module: github.com/omec-project/amf
versions:
- fixed: 1.7.1-0.20260421213846-34bc6724acc9
vulnerable_at: 1.7.0
summary: |-
omec-project amf Vulnerable to Improper Restriction of Operations within the
Bounds of a Memory Buffer in github.com/omec-project/amf
cves:
- CVE-2026-9300
ghsas:
- GHSA-6p7m-c3mw-4gmw
references:
- advisory: https://github.com/advisories/GHSA-6p7m-c3mw-4gmw
- advisory: https://nvd.nist.gov/vuln/detail/CVE-2026-9300
- fix: https://github.com/omec-project/amf/commit/34bc6724acc97dba1f8691e586da95b042cb612d
- fix: https://github.com/omec-project/amf/pull/666
- report: https://github.com/omec-project/amf/issues/679
- web: https://github.com/omec-project/amf
- web: https://vuldb.com/submit/811841
- web: https://vuldb.com/vuln/365247
- web: https://vuldb.com/vuln/365247/cti
source:
id: GHSA-6p7m-c3mw-4gmw
created: 2026-06-30T15:01:57.423266176Z
review_status: UNREVIEWED
Advisory GHSA-6p7m-c3mw-4gmw references a vulnerability in the following Go modules:
Description:
A vulnerability has been found in omec-project amf up to 2.1.1. This affects an unknown part of the component NGSetupRequest Handler. Such manipulation leads to memory corruption. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. It is best practice to apply a patch to resolve this issue.
References:
Cross references:
See doc/quickstart.md for instructions on how to triage this report.