CVE-2026-41136CWE-440

free5GC AMF missing default case in Content-Type switch in HTTPUEContextTransfer

Medium · published April 21, 2026

CVSS v4.0
5.5
EPSS
0%
Percentile
25.3
In the wild
Unconfirmed
What it is

free5GC AMF provides Access & Mobility Management Function (AMF) for free5GC, an an open-source project for 5th generation (5G) mobile core networks. Prior to version 1.4.3, the `HTTPUEContextTransfer` handler in `internal/sbi/api_communication.go` does not include a `default` case in the `Content-Type` switch statement. When a request arrives with an unsupported `Content-Type`, the deserialization step is silently skipped, `err` remains `nil`, and the processor is invoked with a completely uninitialized `UeContextTransferRequest` object. Version 1.4.3 contains a fix.

The record
Technical detail
CVSS v4.0
5.5 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P
EPSS
0.00333 · 25.3th percentile
Weakness
CWE-440 · Expected Behavior Violation
Published
2026-04-21T23:54Z
EPSS history
Timeline
  • 21 APR 23:54Z
    free5GC AMF missing default case in Content-Type switch in HTTPUEContextTransfer
    cvelistv5