CVE-2026-41136

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-41136", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-04-17T12:59:15.738Z", "datePublished": "2026-04-21T23:54:36.727Z", "dateUpdated": "2026-04-22T13:11:10.206Z"}, "containers": {"cna": {"title": "free5GC AMF missing default case in Content-Type switch in HTTPUEContextTransfer", "problemTypes": [{"descriptions": [{"cweId": "CWE-440", "lang": "en", "description": "CWE-440: Expected Behavior Violation", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 5.5, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P", "version": "4.0"}}], "references": [{"name": "https://github.com/free5gc/free5gc/security/advisories/GHSA-r99v-75p9-xqm5", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/free5gc/free5gc/security/advisories/GHSA-r99v-75p9-xqm5"}, {"name": "https://github.com/free5gc/amf/releases/tag/v1.4.3", "tags": ["x_refsource_MISC"], "url": "https://github.com/free5gc/amf/releases/tag/v1.4.3"}], "affected": [{"vendor": "free5gc", "product": "amf", "versions": [{"version": "< 1.4.3", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-21T23:54:36.727Z"}, "descriptions": [{"lang": "en", "value": "free5GC AMF provides Access & Mobility Management Function (AMF) for free5GC, an an open-source project for 5th generation (5G) mobile core networks. Prior to version 1.4.3, the `HTTPUEContextTransfer` handler in `internal/sbi/api_communication.go` does not include a `default` case in the `Content-Type` switch statement. When a request arrives with an unsupported `Content-Type`, the deserialization step is silently skipped, `err` remains `nil`, and the processor is invoked with a completely uninitialized `UeContextTransferRequest` object. Version 1.4.3 contains a fix."}], "source": {"advisory": "GHSA-r99v-75p9-xqm5", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/free5gc/free5gc/security/advisories/GHSA-r99v-75p9-xqm5", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-22T13:11:04.474863Z", "id": "CVE-2026-41136", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-22T13:11:10.206Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-41136", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-22T13:11:04.474863Z"}}}], "references": [{"url": "https://github.com/free5gc/free5gc/security/advisories/GHSA-r99v-75p9-xqm5", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-22T13:10:58.627Z"}}], "cna": {"title": "free5GC AMF missing default case in Content-Type switch in HTTPUEContextTransfer", "source": {"advisory": "GHSA-r99v-75p9-xqm5", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 5.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE"}}], "affected": [{"vendor": "free5gc", "product": "amf", "versions": [{"status": "affected", "version": "< 1.4.3"}]}], "references": [{"url": "https://github.com/free5gc/free5gc/security/advisories/GHSA-r99v-75p9-xqm5", "name": "https://github.com/free5gc/free5gc/security/advisories/GHSA-r99v-75p9-xqm5", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/free5gc/amf/releases/tag/v1.4.3", "name": "https://github.com/free5gc/amf/releases/tag/v1.4.3", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "free5GC AMF provides Access & Mobility Management Function (AMF) for free5GC, an an open-source project for 5th generation (5G) mobile core networks. Prior to version 1.4.3, the `HTTPUEContextTransfer` handler in `internal/sbi/api_communication.go` does not include a `default` case in the `Content-Type` switch statement. When a request arrives with an unsupported `Content-Type`, the deserialization step is silently skipped, `err` remains `nil`, and the processor is invoked with a completely uninitialized `UeContextTransferRequest` object. Version 1.4.3 contains a fix."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-440", "description": "CWE-440: Expected Behavior Violation"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-21T23:54:36.727Z"}}}, "cveMetadata": {"cveId": "CVE-2026-41136", "state": "PUBLISHED", "dateUpdated": "2026-04-22T13:11:10.206Z", "dateReserved": "2026-04-17T12:59:15.738Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-04-21T23:54:36.727Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "amf", "vendor": "free5gc", "versions": [{"status": "affected", "version": "< 1.4.3"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:free5gc:amf:*:*:*:*:*:go:*:*", "matchCriteriaId": "564C38AF-05C1-4D86-809E-47ED1663D8C5", "versionEndExcluding": "1.4.3", "vulnerable": true}, {"criteria": "cpe:2.3:a:free5gc:free5gc:*:*:*:*:*:*:*:*", "matchCriteriaId": "AA20AB40-343A-4B48-9B29-2A700DEC58B8", "versionEndIncluding": "4.2.1", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "free5GC AMF provides Access & Mobility Management Function (AMF) for free5GC, an an open-source project for 5th generation (5G) mobile core networks. Prior to version 1.4.3, the `HTTPUEContextTransfer` handler in `internal/sbi/api_communication.go` does not include a `default` case in the `Content-Type` switch statement. When a request arrives with an unsupported `Content-Type`, the deserialization step is silently skipped, `err` remains `nil`, and the processor is invoked with a completely uninitialized `UeContextTransferRequest` object. Version 1.4.3 contains a fix."}, {"lang": "es", "value": "free5GC AMF proporciona la Funci\u00f3n de Gesti\u00f3n de Acceso y Movilidad (AMF) para free5GC, un proyecto de c\u00f3digo abierto para redes centrales m\u00f3viles de quinta generaci\u00f3n (5G). Antes de la versi\u00f3n 1.4.3, el gestor \u2019HTTPUEContextTransfer\u2019 en \u2019internal/sbi/api_communication.go\u2019 no incluye un caso \u2019default\u2019 en la declaraci\u00f3n \u2019switch\u2019 de \u2019Content-Type\u2019. Cuando llega una solicitud con un \u2019Content-Type\u2019 no compatible, el paso de deserializaci\u00f3n se omite silenciosamente, \u2019err\u2019 permanece \u2019nil\u2019, y el procesador es invocado con un objeto \u2019UeContextTransferRequest\u2019 completamente sin inicializar. La versi\u00f3n 1.4.3 contiene una correcci\u00f3n."}], "id": "CVE-2026-41136", "lastModified": "2026-10-26T22:10:00.163", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "PROOF_OF_CONCEPT", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-41136", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-04-22T13:11:04.474863Z", "version": "2.0.3"}}]}, "published": "2026-04-22T00:16:29.423", "references": [{"source": "security-advisories@github.com", "tags": ["Product", "Release Notes"], "url": "https://github.com/free5gc/amf/releases/tag/v1.4.3"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/free5gc/free5gc/security/advisories/GHSA-r99v-75p9-xqm5"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/free5gc/free5gc/security/advisories/GHSA-r99v-75p9-xqm5"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-440"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.4.3)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "amf", "source": "cna", "vendor": "free5gc"}, "product": "amf", "vendor": "free5gc"}], "analysis": {"en": {"generated_at": "2026-04-22T04:24:36.837829+00:00", "value": {"mitigation_remediation": ["Upgrade free5gc AMF to version 1.4.3 or later", "If an upgrade cannot be performed immediately, block or reject incoming HTTPUEContextTransfer requests that contain unsupported Content-Type values at the network or application layer", "Modify the AMF codebase to include a default case in the Content-Type switch that returns a clear error for unsupported media types, thereby preventing the processor from executing with an uninitialized request"], "summary": {"action": "Apply Patch", "impact": "Denial of Service"}, "threat_synthesis": {"affected_systems": "All free5gc AMF deployments using a release prior to v1.4.3 are impacted. The vulnerability exists in the open\u2011source Free5GC project\u2019s AMF component. Anyone running AMF 1.4.2 or earlier should consider this affected. The fix is shipped in release v1.4.3.", "description_and_impact": "The AMF\u2019s HTTPUEContextTransfer handler performs a Content-Type switch without a default clause. When a request carries an unsupported Content-Type, the deserialization step is silently skipped, leaving err nil and the UeContextTransferRequest object uninitialized. The processor is then invoked with this uninitialized request, which can cause the AMF to misbehave, potentially crash or otherwise expose unpredictable state. This flaw represents the misuse of an uninitialized variable (CWE\u2011440).", "risk_and_exploitability": "The CVSS score of 5.5 indicates moderate severity and the issue is listed as not in KEV, with no EPSS data available. The likely attack vector is remote: an attacker can send an HTTPUEContextTransfer request with an unsupported Content-Type to the AMF. Because the handler silently ignores the bad type and processes an uninitialized request, it can trigger a denial of service or other abnormal behavior. While no proof of exploitation is documented, the moderate CVSS score and lack of a defensive default case suggest a non\u2011zero risk of exploitation in a suitable environment."}}}}, "created": "2026-04-22T02:15:05.235818+00:00", "updated": "2026-04-22T04:30:05.302994+00:00", "vendors": ["free5gc", "free5gc$PRODUCT$amf"]}