CVE-2025-66786: Improper Input Validation

OpenAirInterface CN5G AMF=v2.0.1 There is a logical error when processing JSON format requests. Unauthorized remote attackers can send malicious JSON data to AMF's SBI interface to launch a denial-of-service attack...

CVE-2025-65805: Stack-based Buffer Overflow

OpenAirInterface CN5G AMF=v2.1.9 has a buffer overflow vulnerability in processing NAS messages. Unauthorized remote attackers can launch a denial-of-service attack and potentially execute malicious code by accessing port N1 and sending an imsi string longer than 1000 to AMF...

CVE-2024-24445

OpenAirInterface CN5G AMF oai-cn5g-amf = 2.0.0 contains a null dereference in its handling of unsupported NGAP protocol messages which allows an attacker with network-adjacent access to the AMF to carry out denial of service. When a procedure code/presence field tuple is received that is...

CVE-2024-24442

A NULL pointer dereference in the ngapapp::handlereceive routine of OpenAirInterface CN5G AMF oai-cn5g-amf up to v2.0.0 allows attackers to cause a Denial of Service DoS via a crafted NGAP message...

CVE-2024-24449

An uninitialized pointer dereference in the NasPdu::NasPdu component of OpenAirInterface CN5G AMF up to v2.0.0 allows attackers to cause a Denial of Service DoS via a crafted InitialUEMessage message sent to the AMF...

CVE-2024-24446

An uninitialized pointer dereference in OpenAirInterface CN5G AMF up to v2.0.0 allows attackers to cause a Denial of Service DoS via a crafted InitialContextSetupResponse message sent to the AMF...

CVE-2024-24445

OpenAirInterface CN5G AMF oai-cn5g-amf = 2.0.0 contains a null dereference in its handling of unsupported NGAP protocol messages which allows an attacker with network-adjacent access to the AMF to carry out denial of service. When a procedure code/presence field tuple is received that is...

CVE-2024-24443

The OpenAirInterface CN5G AMF (oai-cn5g-amf) software, in versions up to v2.0.0 , is vulnerable to a Denial of Service (DoS) . The root cause is an uninitialized pointer dereference within the ngap_handle_pdu_session_resource_setup_response routine. An attacker can exploit this by sending a craft...

CVE-2024-24445

The OpenAirInterface CN5G AMF (oai-cn5g-amf) software, version 2.0.0 and earlier , is vulnerable to a null dereference during the processing of unsupported NGAP protocol messages . Specifically, when the software receives an unsupported procedure code/presence field tuple, it indexes into a null ...

CVE-2024-24442

A NULL pointer dereference in the ngapapp::handlereceive routine of OpenAirInterface CN5G AMF oai-cn5g-amf up to v2.0.0 allows attackers to cause a Denial of Service DoS via a crafted NGAP message...

PT-2025-2381

Name of the Vulnerable Software and Affected Versions: OpenAirInterface CN5G AMF oai-cn5g-amf versions up to v2.0.0 Description: A NULL pointer dereference in the ngap app::handle receive routine allows attackers to cause a Denial of Service DoS via a crafted NGAP message. This issue can be...

CVE-2024-24442

A NULL pointer dereference in the ngapapp::handlereceive routine of OpenAirInterface CN5G AMF oai-cn5g-amf up to v2.0.0 allows attackers to cause a Denial of Service DoS via a crafted NGAP message...

CVE-2024-24451

The OpenAirInterface CN5G AMF (oai-cn5g-amf) software, versions up to v2.0.0 , is vulnerable to a stack overflow within the sctp_server::sctp_receiver_thread component. An attacker can exploit this vulnerability by repeatedly establishing SCTP connections with the N2 interface , leading to a Deni...

CVE-2024-24450

Stack-based memcpy buffer overflow in the ngaphandlepdusessionresourcesetupresponse routine in OpenAirInterface CN5G AMF = 2.0.0 allows a remote attacker with access to the N2 interface to carry out denial of service against the AMF and potentially execute code by sending a PDU Session Resource...

CVE-2024-24446

The OpenAirInterface CN5G AMF software, in versions up to 2.0.0 , is vulnerable to an uninitialized pointer dereference . An attacker can exploit this flaw by sending a crafted InitialContextSetupResponse message to the AMF, resulting in a Denial of Service (DoS) . To resolve this issue, it is re...

CVE-2024-24447

A buffer overflow vulnerability exists in the ngap_amf_handle_pdu_session_resource_setup_response function of oai-cn5g-amf up to version v2.0.0 . Attackers can trigger a Denial of Service (DoS) by sending a PDU Session Resource Setup Response containing an empty Response Item list. As a temporary...

CVE-2024-24449

An uninitialized pointer dereference in the NasPdu::NasPdu component of OpenAirInterface CN5G AMF up to v2.0.0 allows attackers to cause a Denial of Service DoS via a crafted InitialUEMessage message sent to the AMF...