Openairinterface vulnerabilities
We track 9 vulnerabilities in Openairinterface products across 4 products. 9 are rated high or critical, and none are known to be exploited. The most recent was published on June 1, 2026.
Latest Openairinterface vulnerabilities
- 8.6 High severity
Openairinterface5g: Divide By Zero
An issue was discovered in OpenAirInterface5G 2.4.0 (nr-softmodem) in the E2SM-KPM RAN Function's PRB utilization metric calculation. The functions fill_RRU_PrbTotDl() and fill_RRU_PrbTotUl() in openair2/E2AP/RAN_FUNCTION/O-RAN/ran_func_kpm_subs.c (lines 182 a
- 7.5 High severity
Oai-cn5g-amf: Authentication Bypass by Capture-replay
OpenAirInterface v2.2.0 accepts Security Mode Complete without any integrity protection. Configuration has supported integrity NIA1 and NIA2. But if an UE sends initial registration request with only security capability IA0, OpenAirInterface accepts and procee
- 7.5 High severity
Oai-cn5g-amf: Buffer Copy without Checking Size of Input
OpenAirInterface Version 2.2.0 has a Buffer Overflow vulnerability in processing UplinkNASTransport containing Authentication Response containing a NAS PDU with oversize response (For example 100 byte). The response is decoded by AMF and passed to the AUSF com
- 9.8 Critical severity
Oai-cn5g-amf: Authentication Bypass Using an Alternate Path or Channel
In OpenAirInterface V2.2.0 AMF, Out of sequence messages causes incorrect state transition during UE registration procedure. This allows authentication to be bypassed completely. If a SecurityModeComplete message is sent after InitialUERegistration, a registra
- 7.5 High severity
OpenAirInterface V2.2.0 AMF crashes when it receives an NGAP message with invalid procedure…
OpenAirInterface V2.2.0 AMF crashes when it receives an NGAP message with invalid procedure code or invalid PDU-type. For example when the message specification requires InitiatingMessage but sent with successfulOutcome.
- 7.5 High severity
OpenAirInterface V2.2.0 AMF crashes when it fails to decode the message.
OpenAirInterface V2.2.0 AMF crashes when it fails to decode the message. Not all decode failures result in a crash. But the crash is consistent for particular inputs. An example input in hex stream is 80 00 00 0E 00 00 01 00 0F 80 02 02 40 00 58 00 01 88.
- 7.5 High severity
OpenAirInterface CN5G AMF<=v2.0.1 There is a logical error when processing JSON format requests.
OpenAirInterface CN5G AMF<=v2.0.1 There is a logical error when processing JSON format requests. Unauthorized remote attackers can send malicious JSON data to AMF's SBI interface to launch a denial-of-service attack.
- 7.5 High severity
Oai-cn5g-amf: Stack-based Buffer Overflow
OpenAirInterface CN5G AMF<=v2.1.9 has a buffer overflow vulnerability in processing NAS messages. Unauthorized remote attackers can launch a denial-of-service attack and potentially execute malicious code by accessing port N1 and sending an imsi string longer
- 7.5 High severity
magma: Improper Neutralization of Special Elements used in an OS Command
Reachable assertions in the NGAP_FIND_PROTOCOLIE_BY_ID function of OpenAirInterface Magma v1.8.0 and OAI EPC Federation v1.2.0 allow attackers to cause a Denial of Service (DoS) via a crafted NGAP packet.