{"dataType": "CVE_RECORD", "cveMetadata": {"state": "PUBLISHED", "cveId": "CVE-2026-30077", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "dateUpdated": "2026-03-30T18:32:16.303Z", "dateReserved": "2026-03-04T00:00:00.000Z", "datePublished": "2026-03-30T00:00:00.000Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2026-03-30T17:24:49.838Z"}, "descriptions": [{"lang": "en", "value": "OpenAirInterface V2.2.0 AMF crashes when it fails to decode the message. Not all decode failures result in a crash. But the crash is consistent for particular inputs. An example input in hex stream is 80 00 00 0E 00 00 01 00 0F 80 02 02 40 00 58 00 01 88."}], "affected": [{"vendor": "n/a", "product": "n/a", "versions": [{"version": "n/a", "status": "affected"}]}], "references": [{"url": "https://gitlab.eurecom.fr/oai/cn5g/oai-cn5g-amf/-/issues/76"}, {"url": "https://gitlab.eurecom.fr/oai/cn5g/oai-cn5g-amf/-/merge_requests/414"}], "problemTypes": [{"descriptions": [{"type": "text", "lang": "en", "description": "n/a"}]}]}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-20", "lang": "en", "description": "CWE-20 Improper Input Validation"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-03-30T18:30:45.467369Z", "id": "CVE-2026-30077", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-30T18:32:16.303Z"}}]}, "dataVersion": "5.2"}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-30077", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-30T18:30:45.467369Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-20", "description": "CWE-20 Improper Input Validation"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-30T18:31:35.982Z"}}], "cna": {"affected": [{"vendor": "n/a", "product": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "references": [{"url": "https://gitlab.eurecom.fr/oai/cn5g/oai-cn5g-amf/-/issues/76"}, {"url": "https://gitlab.eurecom.fr/oai/cn5g/oai-cn5g-amf/-/merge_requests/414"}], "descriptions": [{"lang": "en", "value": "OpenAirInterface V2.2.0 AMF crashes when it fails to decode the message. Not all decode failures result in a crash. But the crash is consistent for particular inputs. An example input in hex stream is 80 00 00 0E 00 00 01 00 0F 80 02 02 40 00 58 00 01 88."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "text", "description": "n/a"}]}], "providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2026-03-30T17:24:49.838Z"}}}, "cveMetadata": {"cveId": "CVE-2026-30077", "state": "PUBLISHED", "dateUpdated": "2026-03-30T18:32:16.303Z", "dateReserved": "2026-03-04T00:00:00.000Z", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "datePublished": "2026-03-30T00:00:00.000Z", "assignerShortName": "mitre"}, "dataVersion": "5.2"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:openairinterface:openairinterface:2.2.0:*:*:*:*:*:*:*", "matchCriteriaId": "A4D4C2EA-57B3-42F2-9794-5DA2ADF51B23", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "OpenAirInterface V2.2.0 AMF crashes when it fails to decode the message. Not all decode failures result in a crash. But the crash is consistent for particular inputs. An example input in hex stream is 80 00 00 0E 00 00 01 00 0F 80 02 02 40 00 58 00 01 88."}, {"lang": "es", "value": "OpenAirInterface V2.2.0 AMF se bloquea cuando no logra decodificar el mensaje. No todas las fallas de decodificaci\u00f3n resultan en un bloqueo. Pero el bloqueo es consistente para entradas particulares. Una entrada de ejemplo en flujo hexadecimal es 80 00 00 0E 00 00 01 00 0F 80 02 02 40 00 58 00 01 88."}], "id": "CVE-2026-30077", "lastModified": "2026-04-06T15:59:48.847", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}, "published": "2026-03-30T18:16:18.660", "references": [{"source": "cve@mitre.org", "tags": ["Third Party Advisory", "Issue Tracking"], "url": "https://gitlab.eurecom.fr/oai/cn5g/oai-cn5g-amf/-/issues/76"}, {"source": "cve@mitre.org", "tags": ["Issue Tracking", "Mitigation"], "url": "https://gitlab.eurecom.fr/oai/cn5g/oai-cn5g-amf/-/merge_requests/414"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-20"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "2.2.0"}}], "enrichment": {"confidence": 80.0, "confidence_source": "inferred", "scores": [{"score": 80.0, "source": "inferred"}]}, "original": {"product": "n/a", "source": "cna", "vendor": "n/a"}, "product": "oai_cn5g_amf", "vendor": "eurecom"}], "analysis": {"en": {"generated_at": "2026-04-06T19:31:16.420685+00:00", "value": {"mitigation_remediation": ["Upgrade to the patched OpenAirInterface version that includes the fix from merge request 414", "If an upgrade is not immediately possible, merge the patch changes manually into the codebase and rebuild the AMF"], "summary": {"action": "Apply Patch", "impact": "Denial of Service caused by application crash via malformed messages"}, "threat_synthesis": {"affected_systems": "The vulnerability affects the OpenAirInterface 2.2.0 AMF component. No other vendors or product versions are listed as impacted. Systems deploying this specific firmware are at risk.", "description_and_impact": "OpenAirInterface v2.2.0 AMF contains a flaw in its message decoding logic that causes the process to crash when presented with specific malformed input. The issue represents an input validation weakness (CWE\u201120) that can be exploited by an attacker who can craft a network packet matching the problematic byte sequence, resulting in an immediate loss of service for users depending on the AMF. The crash leads to a denial of service, potentially disrupting the handover and control functions within a 5G core network, but does not provide direct remote code execution or data exfiltration.", "risk_and_exploitability": "The CVSS score of 7.5 highlights a high severity, while the EPSS score of less than 1% indicates a low overall exploit probability. The vulnerability is not currently in the CISA KEV catalog, but the existence of a dedicated merge request suggests that it is being actively addressed. Attackers would need to send crafted NR protocol messages to the AMF; the crash only occurs with particular inputs, so an attacker might need to perform reconnaissance or trial-and-error to identify the exact payload. The risk to organizations running this software is moderate to high, largely contingent on exposure to externally reachable 5G traffic."}}}}, "created": "2026-03-30T20:56:18.687974+00:00", "updated": "2026-04-07T08:08:43.308275+00:00", "vendors": ["eurecom", "eurecom$PRODUCT$oai_cn5g_amf"]}