CVE-2026-117067

An out-of-bounds memory access vulnerability in the N2 SCTP interface of OpenAirInterface OAI CN5G AMF v2.2.1 allows an unauthenticated remote attacker to cause a denial of service DoS by repeatedly establishing SCTP associations, resulting in a process crash due to improper file descriptor bound...

CVE-2026-117067

The OpenAirInterface (OAI) CN5G AMF v2.2.1 software is susceptible to an out-of-bounds memory access vulnerability within the N2 SCTP interface . The root cause is improper file descriptor bounds checking during the FD_SET() operation. An unauthenticated remote attacker can exploit this by repeat...

CVE-2026-117067

An out-of-bounds memory access vulnerability in the N2 SCTP interface of OpenAirInterface OAI CN5G AMF v2.2.1 allows an unauthenticated remote attacker to cause a denial of service DoS by repeatedly establishing SCTP associations, resulting in a process crash due to improper file descriptor bound...

CVE-2025-65805: Stack-based Buffer Overflow

OpenAirInterface CN5G AMF=v2.1.9 has a buffer overflow vulnerability in processing NAS messages. Unauthorized remote attackers can launch a denial-of-service attack and potentially execute malicious code by accessing port N1 and sending an imsi string longer than 1000 to AMF...

CVE-2025-66786: Improper Input Validation

OpenAirInterface CN5G AMF=v2.0.1 There is a logical error when processing JSON format requests. Unauthorized remote attackers can send malicious JSON data to AMF's SBI interface to launch a denial-of-service attack...

CVE-2025-66786

OpenAirInterface CN5G AMF=v2.0.1 There is a logical error when processing JSON format requests. Unauthorized remote attackers can send malicious JSON data to AMF's SBI interface to launch a denial-of-service attack...

CVE-2025-65805

OpenAirInterface CN5G AMF=v2.1.9 has a buffer overflow vulnerability in processing NAS messages. Unauthorized remote attackers can launch a denial-of-service attack and potentially execute malicious code by accessing port N1 and sending an imsi string longer than 1000 to AMF...

CVE-2024-24445

OpenAirInterface CN5G AMF oai-cn5g-amf = 2.0.0 contains a null dereference in its handling of unsupported NGAP protocol messages which allows an attacker with network-adjacent access to the AMF to carry out denial of service. When a procedure code/presence field tuple is received that is...

CVE-2024-24442

A NULL pointer dereference in the ngapapp::handlereceive routine of OpenAirInterface CN5G AMF oai-cn5g-amf up to v2.0.0 allows attackers to cause a Denial of Service DoS via a crafted NGAP message...

CVE-2024-24449

An uninitialized pointer dereference in the NasPdu::NasPdu component of OpenAirInterface CN5G AMF up to v2.0.0 allows attackers to cause a Denial of Service DoS via a crafted InitialUEMessage message sent to the AMF...

CVE-2024-24446

An uninitialized pointer dereference in OpenAirInterface CN5G AMF up to v2.0.0 allows attackers to cause a Denial of Service DoS via a crafted InitialContextSetupResponse message sent to the AMF...

CVE-2024-24445

OpenAirInterface CN5G AMF oai-cn5g-amf = 2.0.0 contains a null dereference in its handling of unsupported NGAP protocol messages which allows an attacker with network-adjacent access to the AMF to carry out denial of service. When a procedure code/presence field tuple is received that is...

CVE-2024-24445: NULL Pointer Dereference

OpenAirInterface CN5G AMF oai-cn5g-amf = 2.0.0 contains a null dereference in its handling of unsupported NGAP protocol messages which allows an attacker with network-adjacent access to the AMF to carry out denial of service. When a procedure code/presence field tuple is received that is...

CVE-2024-24443: NULL Pointer Dereference

An uninitialized pointer dereference in the ngaphandlepdusessionresourcesetupresponse routine of OpenAirInterface CN5G AMF oai-cn5g-amf up to v2.0.0 allows attackers to cause a Denial of Service DoS via a crafted PDU Session Resource Setup Response...

CVE-2024-24445

OpenAirInterface CN5G AMF (oai-cn5g-amf) versions 2.0.0 and earlier are vulnerable to a null pointer dereference during the processing of unsupported NGAP protocol messages . When the software receives a procedure code/presence field tuple that is not supported, it indexes into a null function po...

CVE-2024-24442

A NULL pointer dereference in the ngapapp::handlereceive routine of OpenAirInterface CN5G AMF oai-cn5g-amf up to v2.0.0 allows attackers to cause a Denial of Service DoS via a crafted NGAP message...

CVE-2024-24444: Missing Release of File Descriptor or Handle after Effective Lifetime

Improper file descriptor handling for closed connections in OpenAirInterface CN5G AMF oai-cn5g-amf up to v2.0.0 allows attackers to cause a Denial of Service DoS by repeatedly establishing SCTP connections with the N2 interface...

CVE-2024-24442: NULL Pointer Dereference

A NULL pointer dereference in the ngapapp::handlereceive routine of OpenAirInterface CN5G AMF oai-cn5g-amf up to v2.0.0 allows attackers to cause a Denial of Service DoS via a crafted NGAP message...

CVE-2024-24443

The OpenAirInterface CN5G AMF (oai-cn5g-amf) software, in versions up to v2.0.0 , is vulnerable to a Denial of Service (DoS) . The root cause is an uninitialized pointer dereference within the ngap_handle_pdu_session_resource_setup_response routine. An attacker can exploit this by sending a craft...

PT-2025-2381

Name of the Vulnerable Software and Affected Versions: OpenAirInterface CN5G AMF oai-cn5g-amf versions up to v2.0.0 Description: A NULL pointer dereference in the ngap app::handle receive routine allows attackers to cause a Denial of Service DoS via a crafted NGAP message. This issue can be...