The vulnerability in free5GC AMF affects the HTTPUEContextTransfer handler in the internal/sbi/api_communication.go file. When a request with an unsupported Content-Type header is received, the absence of a default case in the switch statement causes the deserialization step to be skipped without error. Consequently, the processor is called with an uninitialized UeContextTransferRequest object, which violates expected behavior and could lead to logic errors or unstable processing. This issue is addressed in free5GC AMF version 1.4.3.

The impact is that the AMF component may process uninitialized data when handling requests with unsupported Content-Type headers, potentially causing unexpected behavior or logic errors in the 5G core network function. There is no indication of privilege escalation, data disclosure, or denial of service from the provided data. No known exploits are reported in the wild.

Upgrade free5GC AMF to version 1.4.3 or later, where this issue is fixed. Since no official patch link or vendor advisory is provided, confirm the upgrade from the official free5GC project releases. Patch status is not explicitly confirmed beyond the version fix note; check the vendor advisory for current remediation guidance.