---
id: "CVE-2026-117067"
kind: "vulnerability"
aliases: ["CVE-2026-117067"]
title: "OpenAirInterface AMF: repeated SCTP associations crash the process"
severity: "high"
cvss: null
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "oai-cn5g-amf", "fixed": [], "affected": "v2.2.1", "ecosystem": "vendor"}]
ecosystems: []
tags: ["5g-core", "amf", "infrastructure", "openairinterface", "sctp"]
not_affected_if: ["n2-not-exposed", "other-amf-versions"]
published_at: "2026-11-02T18:18:43+00:00"
first_seen_at: "2026-11-02T18:24:24+00:00"
updated_at: "2026-11-02T18:25:42+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-117067", "first_seen_at": "2026-11-02T18:24:24+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-11-02T18:25:42+00:00"}]
---

# OpenAirInterface AMF: repeated SCTP associations crash the process

OpenAirInterface CN5G AMF v2.2.1 has an out-of-bounds memory access in its N2 SCTP interface, caused by missing file descriptor bounds checks in FD_SET(). An unauthenticated remote attacker can repeatedly open SCTP associations to crash the process, causing denial of service.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:oai-cn5g-amf affected v2.2.1 fixed ?

## How to check

- Check whether the AMF runs OpenAirInterface oai-cn5g-amf v2.2.1 (image tag or git tag).
- Check whether the N2 SCTP port (NGAP, default 38412) is reachable from anything other than your gNBs: firewall rules, security groups, ss -lnS.
- Also check older oai-cn5g-amf releases: the same FD_SET bug was reported for <= 2.0.0 as CVE-2024-24451.

## Timeline

- 2026-11-02T18:24:24+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-117067
- 2026-11-02T18:25:42+00:00 analyst — Only NVD/MITRE text found; no OAI advisory, fix, or patched version located (v2.2.1 is the latest tag I saw, Apr 2026). Same FD_SET bug class was reported in <=2.0.0 (CVE-2024-24451, RANsacked), so it may be a regression or incomplete fix: unconfirmed. Nothing verified.

## Documents

- [describes] NVD CVE-2026-117067 https://nvd.nist.gov/vuln/detail/CVE-2026-117067
- [mentions] RANsacked: same fd_set bug in oai-cn5g-amf <= 2.0.0 (CVE-2024-24451) https://cellularsecurity.org/ransacked.html

## From the sources

An out-of-bounds memory access vulnerability in the N2 SCTP interface of OpenAirInterface (OAI) CN5G AMF v2.2.1 allows an unauthenticated remote attacker to cause a denial of service (DoS) by repeatedly establishing SCTP associations, resulting in a process crash due to improper file descriptor bounds checking in the FD_SET() operation.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_