---
id: "CVE-2026-117068"
kind: "vulnerability"
aliases: ["CVE-2026-117068"]
title: "OpenAirInterface AMF: truncated SUCI crashes the 5G core process"
severity: "high"
cvss: null
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "oai-cn5g-amf", "fixed": [], "affected": "v2.2.1", "ecosystem": "vendor"}]
ecosystems: []
tags: ["5g-core", "amf", "cn5g", "infrastructure", "openairinterface", "telecom"]
not_affected_if: ["other-amf-version"]
published_at: "2026-11-02T18:18:43+00:00"
first_seen_at: "2026-11-02T18:24:24+00:00"
updated_at: "2026-11-02T18:25:35+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-117068", "first_seen_at": "2026-11-02T18:24:24+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-11-02T18:25:35+00:00"}]
---

# OpenAirInterface AMF: truncated SUCI crashes the 5G core process

NVD says OpenAirInterface CN5G AMF v2.2.1 has an integer underflow in DecodeSuci(): a truncated SUCI in a Registration Request causes an out-of-bounds heap read and crashes the AMF, with no authentication. No vendor advisory or fixed version has been found.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:oai-cn5g-amf affected v2.2.1 fixed ?

## How to check

- Check whether your AMF is OpenAirInterface CN5G AMF v2.2.1 (git tag or container image tag).
- Look for DecodeSuci() in the NAS decoder source; per NVD it lacks length validation for the SUCI in the 5GS Mobile Identity IE.
- Also check if you run a newer develop build; no source says whether it is fixed.

## Timeline

- 2026-11-02T18:24:24+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-117068
- 2026-11-02T18:25:35+00:00 analyst — Only NVD found; no vendor advisory, issue or MR for this CVE located (searched Eurecom GitLab/GitHub, changelog). Fix version unknown: v2.2.1 (Apr 2026) changelog mentions 'harden NAS message processing' but does not tie it to this CVE. Reachability on default config unknown. Nothing verified. Sibling CVE-2026-30077 (v2.2.0) is a different bug. Settle by finding the OAI issue/MR or checking the DecodeSuci() source in the latest tag.

## Documents

- [describes] NVD CVE-2026-117068 https://nvd.nist.gov/vuln/detail/CVE-2026-117068

## From the sources

An integer underflow vulnerability in the NAS decoder of OpenAirInterface (OAI) CN5G AMF v2.2.1 allows an unauthenticated remote attacker to cause a denial of service (DoS) via crafted NAS Registration Requests containing a truncated SUCI in the 5GS Mobile Identity IE. Insufficient length validation in the DecodeSuci() function results in an out-of-bounds heap read, causing the AMF process to crash.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_