{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-41136", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-04-17T12:59:15.738Z", "datePublished": "2026-04-21T23:54:36.727Z", "dateUpdated": "2026-04-22T13:11:10.206Z"}, "containers": {"cna": {"title": "free5GC AMF missing default case in Content-Type switch in HTTPUEContextTransfer", "problemTypes": [{"descriptions": [{"cweId": "CWE-440", "lang": "en", "description": "CWE-440: Expected Behavior Violation", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 5.5, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P", "version": "4.0"}}], "references": [{"name": "https://github.com/free5gc/free5gc/security/advisories/GHSA-r99v-75p9-xqm5", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/free5gc/free5gc/security/advisories/GHSA-r99v-75p9-xqm5"}, {"name": "https://github.com/free5gc/amf/releases/tag/v1.4.3", "tags": ["x_refsource_MISC"], "url": "https://github.com/free5gc/amf/releases/tag/v1.4.3"}], "affected": [{"vendor": "free5gc", "product": "amf", "versions": [{"version": "< 1.4.3", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-21T23:54:36.727Z"}, "descriptions": [{"lang": "en", "value": "free5GC AMF provides Access & Mobility Management Function (AMF) for free5GC, an an open-source project for 5th generation (5G) mobile core networks. Prior to version 1.4.3, the `HTTPUEContextTransfer` handler in `internal/sbi/api_communication.go` does not include a `default` case in the `Content-Type` switch statement. When a request arrives with an unsupported `Content-Type`, the deserialization step is silently skipped, `err` remains `nil`, and the processor is invoked with a completely uninitialized `UeContextTransferRequest` object. Version 1.4.3 contains a fix."}], "source": {"advisory": "GHSA-r99v-75p9-xqm5", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/free5gc/free5gc/security/advisories/GHSA-r99v-75p9-xqm5", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-22T13:11:04.474863Z", "id": "CVE-2026-41136", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-22T13:11:10.206Z"}}]}}

{}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:free5gc:amf:*:*:*:*:*:go:*:*", "matchCriteriaId": "564C38AF-05C1-4D86-809E-47ED1663D8C5", "versionEndExcluding": "1.4.3", "vulnerable": true}, {"criteria": "cpe:2.3:a:free5gc:free5gc:*:*:*:*:*:*:*:*", "matchCriteriaId": "AA20AB40-343A-4B48-9B29-2A700DEC58B8", "versionEndIncluding": "4.2.1", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "free5GC AMF provides Access & Mobility Management Function (AMF) for free5GC, an an open-source project for 5th generation (5G) mobile core networks. Prior to version 1.4.3, the `HTTPUEContextTransfer` handler in `internal/sbi/api_communication.go` does not include a `default` case in the `Content-Type` switch statement. When a request arrives with an unsupported `Content-Type`, the deserialization step is silently skipped, `err` remains `nil`, and the processor is invoked with a completely uninitialized `UeContextTransferRequest` object. Version 1.4.3 contains a fix."}], "id": "CVE-2026-41136", "lastModified": "2026-04-23T19:39:32.100", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "PROOF_OF_CONCEPT", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}]}, "published": "2026-04-22T00:16:29.423", "references": [{"source": "security-advisories@github.com", "tags": ["Product", "Release Notes"], "url": "https://github.com/free5gc/amf/releases/tag/v1.4.3"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/free5gc/free5gc/security/advisories/GHSA-r99v-75p9-xqm5"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/free5gc/free5gc/security/advisories/GHSA-r99v-75p9-xqm5"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-440"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.4.3)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "amf", "source": "cna", "vendor": "free5gc"}, "product": "amf", "vendor": "free5gc"}], "analysis": {"en": {"generated_at": "2026-04-22T04:24:36.837829+00:00", "value": {"mitigation_remediation": ["Upgrade free5gc AMF to version 1.4.3 or later", "If an upgrade cannot be performed immediately, block or reject incoming HTTPUEContextTransfer requests that contain unsupported Content-Type values at the network or application layer", "Modify the AMF codebase to include a default case in the Content-Type switch that returns a clear error for unsupported media types, thereby preventing the processor from executing with an uninitialized request"], "summary": {"action": "Apply Patch", "impact": "Denial of Service"}, "threat_synthesis": {"affected_systems": "All free5gc AMF deployments using a release prior to v1.4.3 are impacted. The vulnerability exists in the open\u2011source Free5GC project\u2019s AMF component. Anyone running AMF 1.4.2 or earlier should consider this affected. The fix is shipped in release v1.4.3.", "description_and_impact": "The AMF\u2019s HTTPUEContextTransfer handler performs a Content-Type switch without a default clause. When a request carries an unsupported Content-Type, the deserialization step is silently skipped, leaving err nil and the UeContextTransferRequest object uninitialized. The processor is then invoked with this uninitialized request, which can cause the AMF to misbehave, potentially crash or otherwise expose unpredictable state. This flaw represents the misuse of an uninitialized variable (CWE\u2011440).", "risk_and_exploitability": "The CVSS score of 5.5 indicates moderate severity and the issue is listed as not in KEV, with no EPSS data available. The likely attack vector is remote: an attacker can send an HTTPUEContextTransfer request with an unsupported Content-Type to the AMF. Because the handler silently ignores the bad type and processes an uninitialized request, it can trigger a denial of service or other abnormal behavior. While no proof of exploitation is documented, the moderate CVSS score and lack of a defensive default case suggest a non\u2011zero risk of exploitation in a suitable environment."}}}}, "created": "2026-04-22T02:15:05.235818+00:00", "updated": "2026-04-22T04:30:05.302994+00:00", "vendors": ["free5gc", "free5gc$PRODUCT$amf"]}