{"id":"CVE-2026-117068","kind":"vulnerability","aliases":["CVE-2026-117068"],"related":[],"title":"OpenAirInterface AMF: truncated SUCI crashes the 5G core process","description":"An integer underflow vulnerability in the NAS decoder of OpenAirInterface (OAI) CN5G AMF v2.2.1 allows an unauthenticated remote attacker to cause a denial of service (DoS) via crafted NAS Registration Requests containing a truncated SUCI in the 5GS Mobile Identity IE. Insufficient length validation in the DecodeSuci() function results in an out-of-bounds heap read, causing the AMF process to crash.","summary":"NVD says OpenAirInterface CN5G AMF v2.2.1 has an integer underflow in DecodeSuci(): a truncated SUCI in a Registration Request causes an out-of-bounds heap read and crashes the AMF, with no authentication. No vendor advisory or fixed version has been found.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"oai-cn5g-amf","fixed":[],"affected":"v2.2.1","ecosystem":"vendor"}],"ecosystems":[],"tags":["5g-core","amf","cn5g","infrastructure","openairinterface","telecom"],"not_affected_if":["other-amf-version"],"how_to_check":"- Check whether your AMF is OpenAirInterface CN5G AMF v2.2.1 (git tag or container image tag).\n- Look for DecodeSuci() in the NAS decoder source; per NVD it lacks length validation for the SUCI in the 5GS Mobile Identity IE.\n- Also check if you run a newer develop build; no source says whether it is fixed.","fix":null,"status":"open","published_at":"2026-11-02T18:18:43+00:00","first_seen_at":"2026-11-02T18:24:24+00:00","triaged_at":"2026-11-02T18:24:38+00:00","updated_at":"2026-11-02T18:25:35+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-11-02T18:24:38Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"OpenAirInterface AMF: truncated SUCI crashes the 5G core process","impact":"low","summary":"OpenAirInterface CN5G AMF v2.2.1 has an integer underflow in its NAS decoder, where a truncated SUCI in a Registration Request causes an out-of-bounds heap read. An unauthenticated remote attacker can crash the AMF process, causing denial of service.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["openairinterface","cn5g","amf","5g-core","telecom"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"AMF process crashes, denying registration service to network clients","analyst_note":"Confirm the fixed version and whether the flaw is reachable on default configurations; NVD entry lacks vendor advisory detail.","how_to_check":"- Check whether the AMF in use is OpenAirInterface CN5G AMF `v2.2.1`\n- Look for the `DecodeSuci()` function in the AMF source or build\n- unknown","plain_action":"","needs_analyst":true,"not_affected_if":["other-amf-version"],"who_is_affected":"Operators running the OpenAirInterface CN5G AMF version 2.2.1 that accepts NAS Registration Requests from the network. Deployments not running this AMF version are not affected by this entry. The sources do not say whether specific configurations change exposure.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000694,"input_tokens":4188,"output_tokens":551,"severity_before":"unknown"},"analyst_status":"done","analyst_note":"Confirm the fixed version and whether the flaw is reachable on default configurations; NVD entry lacks vendor advisory detail.","search":"'-117068':12A,15A '-2026':11A,14A '5g':7A,21B '5g-core':20B '5gs':108C 'advisori':64B 'allow':85C 'amf':2A,19A,23B,32B,58B,83C,130C 'attack':89C 'authent':61B 'bound':52B,125C 'caus':47B,91C,128C 'cn5g':18A,24B,31B,82C 'contain':102C 'core':8A,22B 'craft':98C 'crash':5A,56B,133C 'cve':10A,13A 'decod':78C 'decodesuci':39B,117C 'denial':93C 'dos':96C 'fix':66B 'found':70B 'function':118C 'heap':53B,126C 'ident':110C 'ie':111C 'infrastructur':25B 'insuffici':112C 'integ':36B,72C 'length':113C 'mobil':109C 'nas':77C,99C 'nvd':28B 'oai':17A,81C 'oai-cn5g-amf':16A 'openairinterfac':1A,26B,30B,80C 'out-of-bound':49B,122C 'process':9A,131C 'read':54B,127C 'registr':45B,100C 'remot':88C 'request':46B,101C 'result':119C 'say':29B 'servic':95C 'suci':4A,42B,105C 'telecom':27B 'truncat':3A,41B,104C 'unauthent':87C 'underflow':37B,73C 'v2.2.1':33B,84C 'valid':114C 'vendor':63B 'version':67B 'via':97C 'vulner':74C","nicknames":[],"mitigations":[],"who_affected":"Operators running the OpenAirInterface CN5G AMF version 2.2.1 that accepts NAS Registration Requests from the network. Deployments not running this AMF version are not affected by this entry. The sources do not say whether specific configurations change exposure.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["oaicn5gamf"],"ptokens":["amf","cn5g","oai"],"labels":["5gcore","amf","cn5g","high","infrastructure","openairinterface","telecom"],"first_public_at":"2026-11-02T18:18:43+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-117068","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117068","severity":null,"published_at":"2026-11-02T18:18:43+00:00","modified_at":"2026-11-02T18:18:43+00:00","first_seen_at":"2026-11-02T18:24:24+00:00","fetched_at":"2026-11-02T18:24:24+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-117068:1410","url":null,"severity":null,"published_at":"2026-11-02T18:25:35+00:00","modified_at":"2026-11-02T18:25:35+00:00","first_seen_at":"2026-11-02T18:25:35+00:00","fetched_at":"2026-11-02T18:25:35+00:00","note":"Only NVD found; no vendor advisory, issue or MR for this CVE located (searched Eurecom GitLab/GitHub, changelog). Fix version unknown: v2.2.1 (Apr 2026) changelog mentions 'harden NAS message processing' but does not tie it to this CVE. Reachability on default config unknown. Nothing verified. Sibling CVE-2026-30077 (v2.2.0) is a different bug. Settle by finding the OAI issue/MR or checking the DecodeSuci() source in the latest tag."}],"documents":[{"id":53320,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117068","title":"NVD CVE-2026-117068","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}