CVE-2026-8779 omec-project CVE debrief

Who should care

Telecommunications operators deploying OMEC Project's open-source 5G core network, particularly those using AMF versions prior to 2.2.0. Security teams managing 5G N2 interface exposure and network function virtualization infrastructure. Organizations relying on containerized or cloud-native AMF deployments should prioritize patching to prevent potential service disruption from crafted NGAP messages.

Technical summary

The vulnerability exists in the NGSetupRequest handler of the OMEC Project's open-source AMF implementation. The NGSetupRequest is a critical NGAP (Next Generation Application Protocol) message used to establish the N2 interface between the gNB (5G base station) and the AMF. Improper handling of the InformationElement argument in this function can trigger memory corruption, potentially causing denial of service or unpredictable behavior in the AMF. The attack vector is network-based and requires low attack complexity with no user interaction. The vulnerability is classified under CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer). The fix was implemented in pull request #666 and released in version 2.2.0, which also addresses multiple other security issues.

Defensive priority

LOW

Recommended defensive actions

• Upgrade omec-project/amf to version 2.2.0 or later to remediate this vulnerability
• Review and apply the security fixes from pull request #666 which addresses multiple security issues
• Monitor for unauthorized NGAP (Next Generation Application Protocol) traffic targeting AMF NGSetupRequest endpoints
• Implement network segmentation to restrict AMF interface exposure to trusted N2 interfaces only
• Review memory safety practices in NGAP message handling code, particularly for InformationElement parsing

Evidence notes

Vulnerability identified in omec-project/amf repository. The NGSetupRequest function in ngap/handler.go fails to properly validate or handle the InformationElement argument, leading to memory corruption. The fix is contained in pull request #666 and released in version 2.2.0.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.