id: GO-ID-PENDING
modules:
- module: github.com/omec-project/amf
versions:
- fixed: 1.7.1-0.20260421213846-34bc6724acc9
vulnerable_at: 1.7.0
summary: |-
omec-project amf Vulnerable to Improper Restriction of Operations within the
Bounds of a Memory Buffer in github.com/omec-project/amf
cves:
- CVE-2026-9299
ghsas:
- GHSA-m9r6-r5c3-jw4j
references:
- advisory: https://github.com/advisories/GHSA-m9r6-r5c3-jw4j
- advisory: https://nvd.nist.gov/vuln/detail/CVE-2026-9299
- fix: https://github.com/omec-project/amf/commit/34bc6724acc97dba1f8691e586da95b042cb612d
- fix: https://github.com/omec-project/amf/pull/666
- report: https://github.com/omec-project/amf/issues/681
- web: https://github.com/omec-project/amf
- web: https://vuldb.com/submit/811829
- web: https://vuldb.com/vuln/365246
- web: https://vuldb.com/vuln/365246/cti
source:
id: GHSA-m9r6-r5c3-jw4j
created: 2026-06-30T15:01:58.131975596Z
review_status: UNREVIEWED
Advisory GHSA-m9r6-r5c3-jw4j references a vulnerability in the following Go modules:
Description:
A flaw has been found in omec-project amf up to 2.1.1. Affected by this issue is the function PDUSessionResourceModifyIndication of the file /go/src/amf/ngap/handler.go. This manipulation causes memory corruption. Remote exploitation of the attack is possible. The exploit has been published and may be used. Applying a patch is the recommended action to fix this issue.
References:
Cross references:
See doc/quickstart.md for instructions on how to triage this report.