A malformed UERadioCapabilityCheckResponse crashes AMF. Nil Pointer Deference
2026-02-10T00:54:46.247Z ERROR ngap/dispatcher.go:144 NGAP decode error: per data out of range {"component": "AMF", "category": "NGAP", "ran_addr": "127.0.0.1:46591"}
2026-02-10T00:54:54.243Z INFO ngap/handler.go:1289 handle UE Radio Capability Check Response {"component": "AMF", "category": "NGAP", "ran_addr": "127.0.0.1:46591"}
panic: runtime error: invalid memory address or nil pointer dereference
[signal SIGSEGV: segmentation violation code=0x1 addr=0x0 pc=0x136eea7]
goroutine 807 gp=0xc000861180 m=8 mp=0xc000600008 [running]:
panic({0x1624140?, 0x26d9d20?})
/usr/local/go/src/runtime/panic.go:802 +0x168 fp=0xc00002baa8 sp=0xc00002b9f8 pc=0x481128
runtime.panicmem(...)
/usr/local/go/src/runtime/panic.go:262
runtime.sigpanic()
/usr/local/go/src/runtime/signal_unix.go:925 +0x359 fp=0xc00002bb08 sp=0xc00002baa8 pc=0x483ab9
github.com/omec-project/amf/ngap.HandleUERadioCapabilityCheckResponse(0xc0004b7400, 0x0?)
/go/src/amf/ngap/handler.go:1321 +0x5c7 fp=0xc00002bca0 sp=0xc00002bb08 pc=0x136eea7
github.com/omec-project/amf/ngap.DispatchNgapMsg({0x1b369a0, 0x2734720}, 0xc0004b7400, 0xc00102a2e0, 0x0)
/go/src/amf/ngap/dispatcher.go:300 +0x105f fp=0xc00002bfa8 sp=0xc00002bca0 pc=0x136467f
github.com/omec-project/amf/ngap.Dispatch.gowrap1()
/go/src/amf/ngap/dispatcher.go:169 +0x2e fp=0xc00002bfe0 sp=0xc00002bfa8 pc=0x136356e
runtime.goexit({})
/usr/local/go/src/runtime/asm_amd64.s:1693 +0x1 fp=0xc00002bfe8 sp=0xc00002bfe0 pc=0x489ca1
created by github.com/omec-project/amf/ngap.Dispatch in goroutine 700
/go/src/amf/ngap/dispatcher.go:169 +0x5c6
A malformed UERadioCapabilityCheckResponse crashes AMF. Nil Pointer Deference
AMF Version: v2.0.2
Reproduction Step:
Send this following UERadioCapabilityCheckResponse NGAP message
20 2B 00 1B 80 00 01 00 00 40 05 80 EC 1C C5 56 00 0A 00 06 80 14 EB AA 59 6E 00 1E 20 01 00
AMF Log:
Advisory:
This bug has been fixed in the latest release
https://hub.docker.com/layers/omecproject/5gc-amf/rel-2.2.1/images/sha256-8a4c33cdda866094f1989bdeff6d8642fce8de8435f89defd66831c97715f5aa