CVE-2026-14624: AMF Denial of Service Vulnerability in OMEC-project

Technical summary

CVE-2026-14624 is a denial-of-service vulnerability in the OMEC-project AMF's NGSetupRequest handler (/go/src/amf/ngap/handler.go). The vulnerability stems from improper handling of requests (CWE-404), where manipulation of an unspecified function parameter or state leads to resource exhaustion or process termination. The attack vector is CVSS Network (AV:N), requires Low complexity (AC:L), and mandates authenticated access (PR:L). The vulnerability causes availability impact (A:L) with no confidentiality or integrity consequences. Attack execution requires no user interaction (UI:N).

Business impact

Service disruption affecting the AMF component can impact mobile network operations, particularly user authentication and mobility management. In production 5G/4G networks, an AMF outage disrupts call setup, data session establishment, and device handoff capabilities. The attack's requirement for authenticated access limits exposure to scenarios where internal threat actors, compromised service accounts, or supply-chain-inserted credentials pose risk. Organizations dependent on OMEC-project for non-critical or testing environments face lower operational risk; those in production carrier deployments should prioritize remediation to maintain SLA compliance and network availability.

Affected systems

OMEC-project AMF versions 2.0.2 and earlier, and version 2.1.1 are confirmed in scope. The vendor product list in the source data is empty, suggesting either early disclosure or limited vendor packaging of this open-source component. Deployments built directly from OMEC-project source repositories, as well as any downstream products integrating this library (telecommunications vendors, NFV platforms, cloud-RAN operators), are potentially affected. Verify your supply chain and artifact sources to determine exposure.

Exploitability

Exploitation requires authenticated network access, reducing immediate opportunistic attack surface compared to unauthenticated flaws. However, public exploit code is already available, removing the barrier to weaponization for attackers with valid credentials or those able to obtain them through phishing, insider threats, or credential stuffing. The low CVSS score (4.3) reflects the authentication requirement and limited impact scope (availability only), but the public exploit availability and network-accessible nature of the component warrant swift patching in regulated or high-availability environments.

Remediation

Apply the patch identified by commit hash 34bc6724acc97dba1f8691e586da95b042cb612d from the OMEC-project repository. Consult the official OMEC-project release notes and advisories to confirm which version tag incorporates this fix and aligns with your deployment methodology. If using a vendored or packaged version of AMF, contact your vendor for a patched release. In interim environments, network segmentation limiting access to the AMF to trusted administrative networks can reduce attack surface.

Patch guidance

Retrieve the official patch from the OMEC-project repository using the provided commit hash. Verify patch authenticity through project signing keys before deployment. Test the patched version in a non-production environment that mirrors your production setup, particularly focusing on NGSetupRequest processing during device registration and handoff scenarios. Plan patching during maintenance windows to minimize disruption, as AMF outages affect live services. Coordinate with network operations teams to ensure backup and failover procedures are in place during patching. After deployment, monitor logs for any anomalies in request handling or service metrics.

Detection guidance

Monitor AMF process logs and system metrics for signs of resource exhaustion, elevated CPU, or abnormal memory consumption correlated with incoming NGSetupRequest messages from authenticated sources. Implement network-level detection by analyzing NGAP protocol flows for malformed or anomalous NGSetupRequest packets, particularly those with unusual parameter values or sequence violations. Track authentication attempts to the AMF and correlate with subsequent availability events. Log all authenticated API or management interface calls to the AMF, noting source IPs and credential usage patterns. Set alerts for unexpected AMF process restarts or service unavailability following authentication events.

Why prioritize this

Although the CVSS score is medium (4.3) and authentication is required, the combination of public exploit availability, remote network accessibility, and impact on critical mobile network infrastructure warrants prioritization for deployments in production or carrier environments. Organizations using OMEC-project in non-production labs or evaluation settings can defer patching to a routine maintenance cycle. Those with tight SLAs, multi-tenant platforms, or security-sensitive use cases should patch promptly. The vulnerability does not qualify for CISA KEV inclusion, indicating lower perceived active exploitation at scale, but public PoC availability means that window can close rapidly.

Risk score, explained

The CVSS 3.1 score of 4.3 (Medium) reflects the limited scope of impact (availability only, not confidentiality or integrity), the authentication requirement reducing exposure, and the low complexity of exploitation once access is gained. The Network attack vector elevates risk beyond purely internal flaws. Public exploit availability and the criticality of AMF to mobile network function push real-world risk perception above the base score for organizations operating carrier networks or multi-tenant environments, despite the formal score remaining medium. Risk should be elevated internally if your threat model includes insider threats or compromised credential scenarios.

Frequently asked questions