CVE-2026-41136: free5GC AMF missing default case in Content-Type switch in HTTPUEContextTransfer

Severity: medium (CVSS 5.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2026-04-22 · updated 2026-10-26
Weakness: CWE-440

Description

free5GC AMF provides Access & Mobility Management Function (AMF) for free5GC, an an open-source project for 5th generation (5G) mobile core networks. Prior to version 1.4.3, the `HTTPUEContextTransfer` handler in `internal/sbi/api_communication.go` does not include a `default` case in the `Content-Type` switch statement. When a request arrives with an unsupported `Content-Type`, the deserialization step is silently skipped, `err` remains `nil`, and the processor is invoked with a completely uninitialized `UeContextTransferRequest` object. Version 1.4.3 contains a fix.

Affected products

free5gc amf: before 1.4.3 — fixed in 1.4.3
free5gc: through 4.2.1

How to fix

Upgrade to a fixed version: free5gc amf 1.4.3. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-41136 or the next vulnerability affects your stack