Improper handling of NGAP messages in the OpenAirInterface AMF component causes the process to crash when a message with an unexpected procedure code or PDU type is received—for example, an InitiatingMessage that arrives as a SuccessfulOutcome. The resulting crash disables the AMF for all connected nodes, producing a denial‑of‑service outcome.

The AMF portion of OpenAirInterface version 2.2.0 is affected. No vendor name is listed in the CVE record; the project is hosted on a GitLab instance, so the specific vendor is unknown. Users running this version and exposing the AMF to external NGAP traffic fall within the impact zone.

The CVSS base score of 7.5 signals high severity, and the vulnerability is not catalogued in CISA's KEV list. No EPSS score is provided. The likely attack vector is an unauthenticated network adversary transmitting a malformed NGAP packet. The flaw can be triggered without special privileges, making it reasonably likely to be exploited in a hostile environment.