CVE-2026-30075 OpenAirInterface CVE debrief

Who should care

Users and administrators of OpenAirInterface Version 2.2.0 should be aware of this vulnerability and take necessary actions to mitigate the risk. This includes verifying their deployments, monitoring for suspicious activity, and applying vendor remediation when available. Security teams and vulnerability management teams should prioritize this vulnerability due to its potential impact on service availability.

Technical summary

The vulnerability is caused by a buffer overflow in the AMF component when processing UplinkNASTransport containing Authentication Response with an oversized NAS PDU. The response is decoded by AMF and passed to the AUSF component for verification. If the response is oversized (for example, 100 bytes), AUSF crashes, leading to Denial of Services (DoS). This can prohibit users from further registration and verification. The vulnerability affects OpenAirInterface Version 2.2.0.

Defensive priority

High

Recommended defensive actions

• Inventory and verify OpenAirInterface Version 2.2.0 installations
• Implement compensating controls to detect and prevent oversized NAS PDU
• Monitor for suspicious UplinkNASTransport activity
• Apply vendor remediation when available
• Review and update incident response plans to address potential Denial of Services
• Conduct a thorough risk assessment to identify potential exposure
• Verify and document the existence of affected systems in managed environments

Evidence notes

The CVE record was published on 2026-04-08T17:21:18.503Z and was last modified on 2026-07-25T10:10:00.167Z. The NVD entry is currently Analyzed. This information is based on the NVD entry and the CVE record. The vulnerability affects OpenAirInterface Version 2.2.0 and may impact other versions. Users should verify their deployments and monitor for suspicious activity.

Official resources