A null pointer dereference vulnerability exists in omec-project amf versions up to 2.1.3-dev in the UERadioCapabilityCheckResponse function of ngap/dispatcher.go. This flaw allows remote attackers to cause a null pointer dereference, potentially leading to denial of service. The vulnerability has a CVSS 4.0 base score of 5.3 (medium severity) with network attack vector, low attack complexity, no privileges or user interaction required, and limited impact on availability. The vulnerability is publicly disclosed but no known exploits are reported in the wild. Upgrading to version 2.2.0 resolves this issue along with other security fixes.

Successful exploitation can cause a null pointer dereference resulting in denial of service or application crash of the amf component. There is no indication of privilege escalation, data confidentiality, or integrity impact. The vulnerability is remotely exploitable without authentication or user interaction, increasing its risk. However, the overall impact is limited to availability disruption.

Upgrade the omec-project amf component to version 2.2.0 or later, which contains the fix for this vulnerability and other security issues. No other mitigation or temporary workaround is indicated. Patch status is confirmed by the vendor's release notes specifying version 2.2.0 as the remediation.