PT-2026-1850

Name of the Vulnerable Software and Affected Versions OpenAirInterface CN5G AMF versions prior to v2.1.9 Description A buffer overflow condition exists in the processing of NAS messages. Remote attackers can potentially cause a denial-of-service and possibly execute code by sending an imsi string...

CVE-2025-66786: Improper Input Validation

OpenAirInterface CN5G AMF=v2.0.1 There is a logical error when processing JSON format requests. Unauthorized remote attackers can send malicious JSON data to AMF's SBI interface to launch a denial-of-service attack...

CVE-2025-66786

OpenAirInterface CN5G AMF=v2.0.1 There is a logical error when processing JSON format requests. Unauthorized remote attackers can send malicious JSON data to AMF's SBI interface to launch a denial-of-service attack...

CVE-2025-66786

A logical error in the OpenAirInterface CN5G AMF (version v2.0.1 and earlier ) allows unauthorized remote attackers to launch a denial-of-service (DoS) attack. The vulnerability is triggered by sending malicious JSON format requests to the AMF's SBI interface , where improper input validation occ...

CVE-2025-65805: Stack-based Buffer Overflow

OpenAirInterface CN5G AMF=v2.1.9 has a buffer overflow vulnerability in processing NAS messages. Unauthorized remote attackers can launch a denial-of-service attack and potentially execute malicious code by accessing port N1 and sending an imsi string longer than 1000 to AMF...

CVE-2025-65805

OpenAirInterface CN5G AMF=v2.1.9 has a buffer overflow vulnerability in processing NAS messages. Unauthorized remote attackers can launch a denial-of-service attack and potentially execute malicious code by accessing port N1 and sending an imsi string longer than 1000 to AMF...

CVE-2025-66786

OpenAirInterface CN5G AMF=v2.0.1 There is a logical error when processing JSON format requests. Unauthorized remote attackers can send malicious JSON data to AMF's SBI interface to launch a denial-of-service attack...

CVE-2024-24445

OpenAirInterface CN5G AMF oai-cn5g-amf = 2.0.0 contains a null dereference in its handling of unsupported NGAP protocol messages which allows an attacker with network-adjacent access to the AMF to carry out denial of service. When a procedure code/presence field tuple is received that is...

CVE-2024-24447

A buffer overflow in the ngapamfhandlepdusessionresourcesetupresponse function of oai-cn5g-amf up to v2.0.0 allows attackers to cause a Denial of Service DoS via a PDU Session Resource Setup Response with an empty Response Item list...

CVE-2024-24442

A NULL pointer dereference in the ngapapp::handlereceive routine of OpenAirInterface CN5G AMF oai-cn5g-amf up to v2.0.0 allows attackers to cause a Denial of Service DoS via a crafted NGAP message...

CVE-2024-24451

A stack overflow in the sctpserver::sctpreceiverthread component of OpenAirInterface CN5G AMF oai-cn5g-amf up to v2.0.0 allows attackers to cause a Denial of Service DoS by repeatedly establishing SCTP connections with the N2 interface...

CVE-2024-24443

An uninitialized pointer dereference in the ngaphandlepdusessionresourcesetupresponse routine of OpenAirInterface CN5G AMF oai-cn5g-amf up to v2.0.0 allows attackers to cause a Denial of Service DoS via a crafted PDU Session Resource Setup Response...

CVE-2024-24449

An uninitialized pointer dereference in the NasPdu::NasPdu component of OpenAirInterface CN5G AMF up to v2.0.0 allows attackers to cause a Denial of Service DoS via a crafted InitialUEMessage message sent to the AMF...

CVE-2024-24443

An uninitialized pointer dereference in the ngaphandlepdusessionresourcesetupresponse routine of OpenAirInterface CN5G AMF oai-cn5g-amf up to v2.0.0 allows attackers to cause a Denial of Service DoS via a crafted PDU Session Resource Setup Response...

CVE-2024-24445

OpenAirInterface CN5G AMF oai-cn5g-amf = 2.0.0 contains a null dereference in its handling of unsupported NGAP protocol messages which allows an attacker with network-adjacent access to the AMF to carry out denial of service. When a procedure code/presence field tuple is received that is...

CVE-2024-24445: NULL Pointer Dereference

OpenAirInterface CN5G AMF oai-cn5g-amf = 2.0.0 contains a null dereference in its handling of unsupported NGAP protocol messages which allows an attacker with network-adjacent access to the AMF to carry out denial of service. When a procedure code/presence field tuple is received that is...

CVE-2024-24451

A stack overflow in the sctpserver::sctpreceiverthread component of OpenAirInterface CN5G AMF oai-cn5g-amf up to v2.0.0 allows attackers to cause a Denial of Service DoS by repeatedly establishing SCTP connections with the N2 interface...

CVE-2024-24451

A stack overflow exists in the sctp_server::sctp_receiver_thread component of OpenAirInterface CN5G AMF (oai-cn5g-amf) versions up to v2.0.0 . An attacker can exploit this vulnerability by repeatedly establishing SCTP connections with the N2 interface , resulting in a Denial of Service (DoS) . As...

CVE-2024-24445

OpenAirInterface CN5G AMF oai-cn5g-amf = 2.0.0 contains a null dereference in its handling of unsupported NGAP protocol messages which allows an attacker with network-adjacent access to the AMF to carry out denial of service. When a procedure code/presence field tuple is received that is...

CVE-2024-24442

A NULL pointer dereference in the ngapapp::handlereceive routine of OpenAirInterface CN5G AMF oai-cn5g-amf up to v2.0.0 allows attackers to cause a Denial of Service DoS via a crafted NGAP message...