CVE-2026-41136: free5GC AMF Missing Default Case in Content-Type Switch Leading to Uninitialized Request Handling
Summary
CVE-2026-41136: free5GC AMF: Missing default case in Content-Type switch in HTTPUEContextTransfer. Affects github.com/free5gc/amf versions < 1.4.3. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The free5GC AMF (Access and Mobility Management Function) is a core component of the 5G core network, responsible for managing user equipment (UE) context and facilitating communication between network functions. It plays a crucial role in ensuring seamless connectivity and mobility for users in a 5G environment. However, a vulnerability has been identified in the AMF's HTTPUEContextTransfer handler, which can lead to improper handling of requests with unsupported Content-Types.
Vulnerability Detail
The vulnerability arises from the absence of a default case in the Content-Type switch statement within the HTTPUEContextTransfer function in the internal/sbi/api_communication.go file. When a request with an unsupported Content-Type is received, the deserialization step is skipped, leaving the UeContextTransferRequest object uninitialized. This can lead to the processor being invoked with an empty request object, resulting in unintended behavior and potential system instability. Although the processor's validation prevents direct exploitation, relying on it for input checks undermines the intended defense mechanisms.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, ensure that all requests to the UE context transfer endpoint use supported Content-Types (application/json or multipart/related). Any unsupported Content-Type should be rejected at the client-side before reaching the server.
Conclusion
The CVE-2026-41136 vulnerability in the free5GC AMF highlights the importance of proper input validation in API handlers. By implementing the suggested fix and ensuring that only supported Content-Types are used, the integrity and stability of the system can be maintained.
See every vulnerability recorded for github.com/free5gc/amf →
FAQ
CVE-2026-41136 is a vulnerability in the free5GC AMF that results from a missing default case in the Content-Type switch, leading to uninitialized request handling.
The vulnerability can cause the system to process requests with unsupported Content-Types improperly, potentially leading to instability and unintended behavior.
Yes, the vulnerability can be fixed by updating to version 1.4.4 or higher of the free5GC AMF package, which includes the necessary changes.
As a temporary measure, ensure that all requests use supported Content-Types and reject unsupported ones at the client-side.
You can use Vulert, which monitors and alerts in real-time for open-source vulnerabilities in your software. You can check if your application is affected by this vulnerability using the Vulert playground without any signup.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/free5gc/amf.
