CVE-2026-30078: Input Validation

Published Apr 6, 2026

Updated

OpenAirInterface V2.2.0 AMF crashes when it receives an NGAP message with invalid procedure code or invalid PDU-type. For example when the message specification requires InitiatingMessage but sent with successfulOutcome.

Affected Software

1 affected component

openairinterface Oai-cn5g-amf=2.2.0

Event History

Apr 6, 2026

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

Data Sourced

via NVD·02:16 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2026-30078?

CVE-2026-30078 is classified as a high severity vulnerability that can cause the OpenAirInterface V2.2.0 AMF to crash.

How do I fix CVE-2026-30078?

To fix CVE-2026-30078, it is recommended to upgrade to a newer version of the OpenAirInterface AMF that addresses this issue.

What types of messages cause CVE-2026-30078?

CVE-2026-30078 occurs when the OpenAirInterface AMF receives an NGAP message with an invalid procedure code or invalid PDU-type.

Which version of OpenAirInterface is affected by CVE-2026-30078?

CVE-2026-30078 specifically affects version 2.2.0 of the OpenAirInterface OAI-CN5G-AMF.

What are the consequences of CVE-2026-30078?

The consequence of CVE-2026-30078 is a crash of the AMF when it processes certain invalid NGAP messages.