{"id":"CVE-2026-117069","kind":"vulnerability","aliases":["CVE-2026-117069"],"related":[],"title":"OpenAirInterface 5G AMF: crafted registration request crashes core network process","description":"An integer truncation vulnerability in the NAS decoder of OpenAirInterface (OAI) CN5G AMF v2.2.1 allows an unauthenticated remote attacker to cause a denial of service (DoS) via crafted NAS Registration Requests containing a malformed IMEISV in the 5GS Mobile Identity IE. The Type6NasIe::Validate() function truncates a 32-bit length value to 16 bits, bypassing length validation and causing an out-of-bounds heap read in DecodeImeisv(), which can crash the AMF process.","summary":"A length value in the NAS decoder of OpenAirInterface's CN5G AMF v2.2.1 is truncated from 32 to 16 bits, which skips a length check and causes an out-of-bounds heap read during IMEISV decoding. An unauthenticated remote attacker can send a crafted NAS Registration Request to crash the AMF process, causing denial of service.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["5g-core","amf","cn5g","infrastructure","openairinterface"],"not_affected_if":["other-amf-implementation"],"how_to_check":"- Check whether the AMF in use is OpenAirInterface CN5G `v2.2.1` (for example via its version or build tag).\n- Confirm the AMF is reachable from untrusted networks on the N1/NGAP path.","fix":null,"status":"open","published_at":"2026-11-02T19:18:00+00:00","first_seen_at":"2026-11-02T19:24:39+00:00","triaged_at":"2026-11-02T19:26:59+00:00","updated_at":"2026-11-02T19:26:59+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-11-02T19:26:59Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"OpenAirInterface 5G AMF: crafted registration request crashes core network process","impact":"low","summary":"A length value in the NAS decoder of OpenAirInterface's CN5G AMF v2.2.1 is truncated from 32 to 16 bits, which skips a length check and causes an out-of-bounds heap read during IMEISV decoding. An unauthenticated remote attacker can send a crafted NAS Registration Request to crash the AMF process, causing denial of service.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["openairinterface","cn5g","amf","5g-core"],"confidence":0.5,"fix_status":"unknown","needs_auth":"no","worst_case":"AMF process crashes, denying service to registered devices","analyst_note":"Confirm fixed version and patch status for OAI CN5G AMF beyond v2.2.1 via the NVD entry and OpenAirInterface project advisories.","how_to_check":"- Check whether the AMF in use is OpenAirInterface CN5G `v2.2.1` (for example via its version or build tag).\n- Confirm the AMF is reachable from untrusted networks on the N1/NGAP path.","plain_action":"","needs_analyst":true,"not_affected_if":["other-amf-implementation"],"who_is_affected":"Teams running the OpenAirInterface CN5G AMF, typically in private 5G core or lab deployments, where the AMF accepts NAS messages from radio access networks. Deployments running other AMF implementations or versions not stated as affected are not covered by the sources. unknown whether any specific mitigation exists.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000727,"input_tokens":4219,"output_tokens":611,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-117069':13A,16A '-2026':12A,15A '16':42B,133C '32':40B,128C '5g':2A,18B '5g-core':17B '5gs':118C 'allow':95C 'amf':3A,20B,35B,75B,93C,153C 'attack':64B,99C 'bit':43B,129C,134C 'bound':55B,144C 'bypass':135C 'caus':50B,77B,101C,139C 'check':48B 'cn5g':21B,34B,92C 'contain':112C 'core':8A,19B 'craft':4A,68B,108C 'crash':7A,73B,151C 'cve':11A,14A 'decod':30B,60B,88C 'decodeimeisv':148C 'denial':78B,103C 'dos':106C 'function':125C 'heap':56B,145C 'ident':120C 'ie':121C 'imeisv':59B,115C 'infrastructur':22B 'integ':82C 'length':25B,47B,130C,136C 'malform':114C 'mobil':119C 'nas':29B,69B,87C,109C 'network':9A 'oai':91C 'openairinterfac':1A,23B,32B,90C 'out-of-bound':52B,141C 'process':10A,76B,154C 'read':57B,146C 'registr':5A,70B,110C 'remot':63B,98C 'request':6A,71B,111C 'send':66B 'servic':80B,105C 'skip':45B 'truncat':38B,83C,126C 'type6nasie':123C 'unauthent':62B,97C 'v2.2.1':36B,94C 'valid':124C,137C 'valu':26B,131C 'via':107C 'vulner':84C","nicknames":[],"mitigations":[],"who_affected":"Teams running the OpenAirInterface CN5G AMF, typically in private 5G core or lab deployments, where the AMF accepts NAS messages from radio access networks. Deployments running other AMF implementations or versions not stated as affected are not covered by the sources. unknown whether any specific mitigation exists.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["5gcore","amf","cn5g","infrastructure","openairinterface","unknown"],"first_public_at":"2026-11-02T19:18:00+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-117069","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117069","severity":null,"published_at":"2026-11-02T19:18:00+00:00","modified_at":"2026-11-02T19:18:00+00:00","first_seen_at":"2026-11-02T19:24:39+00:00","fetched_at":"2026-11-02T19:24:39+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}