GHSA-fxvj-wqv2-xgcq

Source

https://github.com/advisories/GHSA-fxvj-wqv2-xgcq

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-fxvj-wqv2-xgcq/GHSA-fxvj-wqv2-xgcq.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-fxvj-wqv2-xgcq

Aliases

Published

2026-05-18T03:31:49Z

Modified

2026-06-25T19:56:31Z

Severity

4.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L CVSS Calculator
2.1 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P CVSS Calculator

Summary

AMF Improperly Restricts Operations within the Bounds of a Memory Buffer

Details

A vulnerability was determined in omec-project amf up to 2.1.3-dev. Impacted is the function NGSetupRequest of the file ngap/handler.go. Executing a manipulation of the argument InformationElement can lead to memory corruption. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized. Upgrading to version 2.2.0 is recommended to address this issue. The affected component should be upgraded. The same pull request fixes multiple security issues.

Database specific

{
    "cwe_ids":  [
        "CWE-119"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-05-28T22:40:50Z",
    "nvd_published_at":  "2026-05-18T02:16:37Z",
    "severity":  "LOW"
}

References

Affected packages

Go / github.com/omec-project/amf

Package

Name: github.com/omec-project/amf; View open source insights on deps.dev
Purl: pkg:golang/github.com/omec-project/amf

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

2.2.0

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-fxvj-wqv2-xgcq/GHSA-fxvj-wqv2-xgcq.json"