CVE-2026-41136 Details
Description
free5GC AMF provides Access & Mobility Management Function (AMF) for free5GC, an an open-source project for 5th generation (5G) mobile core networks. Prior to version 1.4.3, the `HTTPUEContextTransfer` handler in `internal/sbi/api_communication.go` does not include a `default` case in the `Content-Type` switch statement. When a request arrives with an unsupported `Content-Type`, the deserialization step is silently skipped, `err` remains `nil`, and the processor is invoked with a completely uninitialized `UeContextTransferRequest` object. Version 1.4.3 contains a fix.
A vulnerability exists in free5GC AMF versions prior to 1.4.3 within the 'HTTPUEContextTransfer' handler. The issue arises because the 'Content-Type' switch statement lacks a 'default' case. As a result, when a request is received with an unsupported 'Content-Type', the deserialization process is silently bypassed, leaving the 'err' variable unchanged. Consequently, the processor is called with a completely uninitialized 'UeContextTransferRequest' object. This vulnerability could disrupt the expected handling of UE context transfer requests, particularly during AMF-to-AMF UE context handovers, by introducing a reliance on the processor's validation logic, which could be inadvertently altered in the future.
Users can upgrade to free5GC AMF version 1.4.3, which addresses this vulnerability by adding the missing 'default' case in the 'Content-Type' switch statement.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 22, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/free5gc/free5gc/security/advisories/GHSA-r99v-75p9-xqm5 | CISA-ADP | ExploitVendor Advisory |
| https://github.com/free5gc/amf/releases/tag/v1.4.3 | [email protected] | ProductRelease Notes |
| https://github.com/free5gc/free5gc/security/advisories/GHSA-r99v-75p9-xqm5 | [email protected] | ExploitVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-440 | Expected Behavior Violation | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| free5gc amf | < 1.4.3 |
CPE
Remediation
| |
| free5gc free5gc | <= 4.2.1 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 23, 2026 | Initial Analysis | [email protected] |
| Apr 22, 2026 | CVE Modified | CISA-ADP |
| Apr 22, 2026 | New CVE Received | [email protected] |