The AMF’s HTTPUEContextTransfer handler performs a Content-Type switch without a default clause. When a request carries an unsupported Content-Type, the deserialization step is silently skipped, leaving err nil and the UeContextTransferRequest object uninitialized. The processor is then invoked with this uninitialized request, which can cause the AMF to misbehave, potentially crash or otherwise expose unpredictable state. This flaw represents the misuse of an uninitialized variable (CWE‑440).

All free5gc AMF deployments using a release prior to v1.4.3 are impacted. The vulnerability exists in the open‑source Free5GC project’s AMF component. Anyone running AMF 1.4.2 or earlier should consider this affected. The fix is shipped in release v1.4.3.

The CVSS score of 5.5 indicates moderate severity and the issue is listed as not in KEV, with no EPSS data available. The likely attack vector is remote: an attacker can send an HTTPUEContextTransfer request with an unsupported Content-Type to the AMF. Because the handler silently ignores the bad type and processes an uninitialized request, it can trigger a denial of service or other abnormal behavior. While no proof of exploitation is documented, the moderate CVSS score and lack of a defensive default case suggest a non‑zero risk of exploitation in a suitable environment.