CVE-2026-41136 free5GC AMF missing default case in Content-Type switch in HTTPUEContextTransfer
Attackers can send requests with unsupported Content-Type headers to cause the AMF to process uninitialized objects, potentially leading to crashes or undefined behavior.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-41136?
CVE-2026-41136 is a medium-severity vulnerability in Free5gc Free5gc, published on 21 Apr 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
free5GC AMF provides Access & Mobility Management Function (AMF) for free5GC, an an open-source project for 5th generation (5G) mobile core networks. Prior to version 1.4.3, the `HTTPUEContextTransfer` handler in `internal/sbi/api_communication.go` does not include a `default` case in the `Content-Type` switch statement. When a request arrives with an unsupported `Content-Type`, the deserialization step is silently skipped, `err` remains `nil`, and the processor is invoked with a completely uninitialized `UeContextTransferRequest` object. Version 1.4.3 contains a fix.
Weakness: CWE-440
Which versions are affected by CVE-2026-41136?
3 open source packages ship an affected version, including github.com/free5gc/amf. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
github.com/free5gc/amf Go | All versions | None |
github.com/free5gc/amf Go | All versions to 1.4.3 | None |
github.com/free5gc/amf Go | All versions to 1.4.3 | None |
Products include Free5gc Amf, Free5gc Free5gc.
How do I fix CVE-2026-41136?
Upgrade to a fixed version.
Is CVE-2026-41136 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-41136 exists.
Other vulnerabilities in Free5gc Free5gc
Sources
Also known as GHSA-r99v-75p9-xqm5, GO-2026-5613.