What’s Vulnerable › Vulnerabilities

CVE-2026-14624: omec-project amf NGSetupRequest handler.go denial of service

• Severity: medium (CVSS 4.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-07-04 · updated 2026-10-25
• Weakness: CWE-404

Description

A vulnerability was identified in omec-project amf up to 2.0.2/2.1.1. Impacted is an unknown function of the file /go/src/amf/ngap/handler.go of the component NGSetupRequest Handler. The manipulation leads to denial of service. It is possible to initiate the attack remotely. The exploit is publicly available and might be used. The identifier of the patch is 34bc6724acc97dba1f8691e586da95b042cb612d. To fix this issue, it is recommended to deploy a patch.

Affected products

• omec-project amf: 2.0.0, 2.0.1, 2.0.2, 2.1.0, 2.1.1

References

• https://github.com/omec-project/amf/
• https://github.com/omec-project/amf/commit/34bc6724acc97dba1f8691e586da95b042cb612d
• https://github.com/omec-project/amf/issues/677
• https://github.com/omec-project/amf/pull/666
• https://vuldb.com/cve/CVE-2026-14624
• https://vuldb.com/submit/845349
• https://vuldb.com/vuln/376140
• https://vuldb.com/vuln/376140/cti
• https://vuldb.com/submit/845349

Get alerted when CVE-2026-14624 or the next vulnerability affects your stack