id: GO-ID-PENDING
modules:
- module: github.com/omec-project/amf
versions:
- fixed: 1.7.1-0.20260421213846-34bc6724acc9
vulnerable_at: 1.7.0
summary: |-
omec-project amf Vulnerable to Improper Restriction of Operations within the
Bounds of a Memory Buffer in github.com/omec-project/amf
cves:
- CVE-2026-9301
ghsas:
- GHSA-qm7q-rcm2-3frc
references:
- advisory: https://github.com/advisories/GHSA-qm7q-rcm2-3frc
- advisory: https://nvd.nist.gov/vuln/detail/CVE-2026-9301
- fix: https://github.com/omec-project/amf/commit/34bc6724acc97dba1f8691e586da95b042cb612d
- fix: https://github.com/omec-project/amf/pull/666
- report: https://github.com/omec-project/amf/issues/678
- web: https://github.com/omec-project/amf
- web: https://vuldb.com/submit/811842
- web: https://vuldb.com/vuln/365248
- web: https://vuldb.com/vuln/365248/cti
source:
id: GHSA-qm7q-rcm2-3frc
created: 2026-06-30T15:01:59.025350412Z
review_status: UNREVIEWED
Advisory GHSA-qm7q-rcm2-3frc references a vulnerability in the following Go modules:
Description:
A vulnerability was found in omec-project amf up to 2.1.1. This vulnerability affects unknown code of the component NGReset Message Handler. Performing a manipulation results in memory corruption. The attack is possible to be carried out remotely. The exploit has been made public and could be used. It is recommended to apply a patch to fix this issue.
References:
Cross references:
See doc/quickstart.md for instructions on how to triage this report.