GHSA-3x4g-259h-5p7c

Suggest an improvement
Source
https://github.com/advisories/GHSA-3x4g-259h-5p7c
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-3x4g-259h-5p7c/GHSA-3x4g-259h-5p7c.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-3x4g-259h-5p7c
Aliases
Published
2026-05-18T03:31:49Z
Modified
2026-06-25T18:56:29Z
Severity
  • 4.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L CVSS Calculator
  • 2.1 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P CVSS Calculator
Summary
AMF Improperly Restricts Operations within the Bounds of a Memory Buffer
Details

A vulnerability was identified in omec-project amf up to 2.1.3-dev. The affected element is an unknown function of the file ngap/dispatcher.go of the component NGAP Message Handler. The manipulation leads to memory corruption. The attack may be initiated remotely. The exploit is publicly available and might be used. Upgrading to version 2.2.0 is sufficient to fix this issue. It is suggested to upgrade the affected component. The same pull request fixes multiple security issues.

Database specific 
{
    "cwe_ids":  [
        "CWE-119"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-05-28T22:41:22Z",
    "nvd_published_at":  "2026-05-18T02:16:37Z",
    "severity":  "LOW"
}
References

Affected packages

Go / github.com/omec-project/amf

Package

Name
github.com/omec-project/amf
View open source insights on deps.dev
Purl
pkg:golang/github.com/omec-project/amf

Affected ranges

Type
SEMVER
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
2.2.0

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-3x4g-259h-5p7c/GHSA-3x4g-259h-5p7c.json"