{"id":"CVE-2026-117067","kind":"vulnerability","aliases":["CVE-2026-117067"],"related":[],"title":"OpenAirInterface AMF: repeated SCTP associations crash the process","description":"An out-of-bounds memory access vulnerability in the N2 SCTP interface of OpenAirInterface (OAI) CN5G AMF v2.2.1 allows an unauthenticated remote attacker to cause a denial of service (DoS) by repeatedly establishing SCTP associations, resulting in a process crash due to improper file descriptor bounds checking in the FD_SET() operation.","summary":"OpenAirInterface CN5G AMF v2.2.1 has an out-of-bounds memory access in its N2 SCTP interface, caused by missing file descriptor bounds checks in FD_SET(). An unauthenticated remote attacker can repeatedly open SCTP associations to crash the process, causing denial of service.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"oai-cn5g-amf","fixed":[],"affected":"v2.2.1","ecosystem":"vendor"}],"ecosystems":[],"tags":["5g-core","amf","infrastructure","openairinterface","sctp"],"not_affected_if":["n2-not-exposed","other-amf-versions"],"how_to_check":"- Check whether the AMF runs OpenAirInterface oai-cn5g-amf v2.2.1 (image tag or git tag).\n- Check whether the N2 SCTP port (NGAP, default 38412) is reachable from anything other than your gNBs: firewall rules, security groups, ss -lnS.\n- Also check older oai-cn5g-amf releases: the same FD_SET bug was reported for <= 2.0.0 as CVE-2024-24451.","fix":null,"status":"open","published_at":"2026-11-02T18:18:43+00:00","first_seen_at":"2026-11-02T18:24:24+00:00","triaged_at":"2026-11-02T18:24:39+00:00","updated_at":"2026-11-02T18:25:42+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-11-02T18:24:39Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"OpenAirInterface AMF: repeated SCTP associations crash the process","impact":"low","summary":"OpenAirInterface CN5G AMF v2.2.1 has an out-of-bounds memory access in its N2 SCTP interface, caused by missing file descriptor bounds checks in FD_SET(). An unauthenticated remote attacker can repeatedly open SCTP associations to crash the process, causing denial of service.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["openairinterface","5g-core","amf","sctp"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"AMF process crashes, causing denial of service to the core network","analyst_note":"Confirm the fixed version and whether the N2 SCTP interface is reachable beyond trusted networks; check the OAI project advisories and the NVD entry.","how_to_check":"- Check whether the AMF in use is OpenAirInterface CN5G AMF version `v2.2.1`\n- Look for the N2 interface (SCTP on the NGAP port) exposed to untrusted networks\n- unknown for other checks","plain_action":"","needs_analyst":true,"not_affected_if":["other-amf-versions"],"who_is_affected":"Operators running the OpenAirInterface CN5G AMF v2.2.1 core network function with an exposed N2 SCTP interface are affected. The sources do not say which deployment settings make it reachable, and they do not name a fixed version.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000703,"input_tokens":4166,"output_tokens":573,"severity_before":"unknown"},"analyst_status":"done","analyst_note":"Confirm the fixed version and whether the N2 SCTP interface is reachable beyond trusted networks; check the OAI project advisories and the NVD entry.","search":"'-117067':11A,14A '-2026':10A,13A '5g':20B '5g-core':19B 'access':37B,76C 'allow':89C 'amf':2A,18A,22B,28B,87C 'associ':5A,61B,105C 'attack':56B,93C 'bound':35B,48B,74C,116C 'caus':43B,66B,95C 'check':49B,117C 'cn5g':17A,27B,86C 'core':21B 'crash':6A,63B,110C 'cve':9A,12A 'denial':67B,97C 'descriptor':47B,115C 'dos':100C 'due':111C 'establish':103C 'fd':51B,120C 'file':46B,114C 'improp':113C 'infrastructur':23B 'interfac':42B,82C 'memori':36B,75C 'miss':45B 'n2':40B,80C 'oai':16A,85C 'oai-cn5g-amf':15A 'open':59B 'openairinterfac':1A,24B,26B,84C 'oper':122C 'out-of-bound':32B,71C 'process':8A,65B,109C 'remot':55B,92C 'repeat':3A,58B,102C 'result':106C 'sctp':4A,25B,41B,60B,81C,104C 'servic':69B,99C 'set':52B,121C 'unauthent':54B,91C 'v2.2.1':29B,88C 'vulner':77C","nicknames":[],"mitigations":[],"who_affected":"Teams running OpenAirInterface CN5G AMF v2.2.1 (labs, private 5G and research cores) are affected if the N2 SCTP port accepts connections from untrusted hosts. An unauthenticated attacker who repeatedly opens SCTP associations can crash the AMF process. Deployments where N2 is reachable only from trusted gNBs on an isolated network are at much lower risk. No fixed version is published in the sources I could read.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["oaicn5gamf"],"ptokens":["amf","cn5g","oai"],"labels":["5gcore","amf","high","infrastructure","openairinterface","sctp"],"first_public_at":"2026-11-02T18:18:43+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-117067","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117067","severity":null,"published_at":"2026-11-02T18:18:43+00:00","modified_at":"2026-11-02T18:18:43+00:00","first_seen_at":"2026-11-02T18:24:24+00:00","fetched_at":"2026-11-02T18:24:24+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-117067:1411","url":null,"severity":null,"published_at":"2026-11-02T18:25:42+00:00","modified_at":"2026-11-02T18:25:42+00:00","first_seen_at":"2026-11-02T18:25:42+00:00","fetched_at":"2026-11-02T18:25:42+00:00","note":"Only NVD/MITRE text found; no OAI advisory, fix, or patched version located (v2.2.1 is the latest tag I saw, Apr 2026). Same FD_SET bug class was reported in <=2.0.0 (CVE-2024-24451, RANsacked), so it may be a regression or incomplete fix: unconfirmed. Nothing verified."}],"documents":[{"id":53321,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117067","title":"NVD CVE-2026-117067","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":53322,"url":"https://cellularsecurity.org/ransacked.html","title":"RANsacked: same fd_set bug in oai-cn5g-amf <= 2.0.0 (CVE-2024-24451)","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}