Issues

• [Bug] AMF crashes when N2 forwards a mismatched UE ID into N1 empty-context cleanup

  openairinterface/oai-cn5g-amf#52 · Filter by author ComFuzz opened on Oct 31, 2026

• Mobile reachable timer is not started when only the NGAP context is released

  openairinterface/oai-cn5g-amf#50 · Filter by author jihoon-seo opened on Oct 29, 2026

• [SEC-VUL-OAI-CN5G-AMF]: "Decode5gSTmsi reads a fixed 7-byte layout regardless of the length indicator (silent heap over-read)"

  openairinterface/oai-cn5g-amf#47 · Filter by author kuangyu263371-svg opened on Oct 26, 2026

• [SEC-VUL-OAI-CN5G-AMF]: "PayloadContainer::Decode advances the cursor past the buffer when decode_bstring fails (remote heap out-of-bounds read)"

  Bug

  openairinterface/oai-cn5g-amf#46 · Filter by author kuangyu263371-svg opened on Oct 26, 2026
  1

• [Bug] AMF accepts registration updates with ngKSI inconsistent with the existing NAS security context

  openairinterface/oai-cn5g-amf#45 · Filter by author dzdysl opened on Oct 23, 2026

• AMF sends Registration Accept after a failed NAS integrity check, skipping the authentication and security recovery required for a mobility update

  openairinterface/oai-cn5g-amf#44 · Filter by author dzdysl opened on Oct 22, 2026

• AMF accepts registration updates but rejects valid Registration Complete

  openairinterface/oai-cn5g-amf#42 · Filter by author dzdysl opened on Oct 18, 2026

• Infinite loop (DoS) decoding SECURITY MODE COMPLETE: unhandled 5GS mobile identity type stalls NAS decode

  openairinterface/oai-cn5g-amf#41 · Filter by author ahemtiaz opened on Oct 17, 2026

• A rogue NRF profile with an empty nfServices[0].versions array aborts the AMF on the first UE PDU session

  openairinterface/oai-cn5g-amf#40 · Filter by author hackeryounow opened on Oct 16, 2026

• [Bug] GUTI parsing corrupts TMSI and mobility registration update reuses the old GUTI

  openairinterface/oai-cn5g-amf#38 · Filter by author dzdysl opened on Oct 15, 2026
  1

  

• Complete the PDU Session Resource Modify Response handling: optional IEs and error propagation

  closed-loop-qos
  openairinterface/oai-cn5g-amf#34 · Filter by author phine-lukas opened on Oct 13, 2026

• OAI CN5G AMF rejects secondary PLMN registration

  openairinterface/oai-cn5g-amf#23 · Filter by author GuidoCasati opened on Oct 1, 2026
  

• AMF: Uplink NAS Transport with a mismatched AMF-UE-NGAP-ID terminates the AMF

  openairinterface/oai-cn5g-amf#20 · Filter by author p1-martin opened on Sep 22, 2026
  

• AMF: N1N2MessageSubscribe response timeout may orphan stored subscriptions

  openairinterface/oai-cn5g-amf#19 · Filter by author ae878 opened on Sep 20, 2026
  

• Second UE-triggered Service Request after AN UP deactivate: UL UP does not come back (no SMF SR step 1 / UL PDR)

  openairinterface/oai-cn5g-amf#12 · Filter by author GuidoCasati opened on Sep 10, 2026
  4

  

• [Bug] AMF procedure state and ngKSI become inconsistent after an out-of-order SecurityModeReject

  openairinterface/oai-cn5g-amf#9 · Filter by author dzdysl opened on Sep 1, 2026
  8

  

• AMF: NGAP Path Switch Request procedure (TS 38.413 §8.4.4) not handled — Xn-based inter-gNB handover cannot complete

  openairinterface/oai-cn5g-amf#8 · Filter by author safwan2mo opened on Aug 28, 2026