Live › vulnerability › CVE-2026-117067
OpenAirInterface CN5G AMF v2.2.1 has an out-of-bounds memory access in its N2 SCTP interface, caused by missing file descriptor bounds checks in FD_SET(). An unauthenticated remote attacker can repeatedly open SCTP associations to crash the process, causing denial of service.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-02 18:24 UTC. All times on this page are UTC.
Teams running OpenAirInterface CN5G AMF v2.2.1 (labs, private 5G and research cores) are affected if the N2 SCTP port accepts connections from untrusted hosts. An unauthenticated attacker who repeatedly opens SCTP associations can crash the AMF process. Deployments where N2 is reachable only from trusted gNBs on an isolated network are at much lower risk. No fixed version is published in the sources I could read.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| oai-cn5g-amf | vendor | v2.2.1 | – |
No fix yet, per the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
An out-of-bounds memory access vulnerability in the N2 SCTP interface of OpenAirInterface (OAI) CN5G AMF v2.2.1 allows an unauthenticated remote attacker to cause a denial of service (DoS) by repeatedly establishing SCTP associations, resulting in a process crash due to improper file descriptor bounds checking in the FD_SET() operation.
This page as .md · .json · in your agent: get_signal("CVE-2026-117067")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.