CVE-2026-41136: CWE-440: Expected Behavior Violation in free5gc amf
CVE-2026-41136 is a medium severity vulnerability in free5GC AMF versions prior to 1. 4. 3. The issue arises because the HTTPUEContextTransfer handler lacks a default case for unsupported Content-Type headers, causing deserialization to be skipped silently and the processor to handle an uninitialized request object. This behavior violates expected processing logic and could lead to unexpected application behavior. A fix was introduced in version 1. 4. 3.
AI Analysis
Technical Summary
The vulnerability in free5GC AMF occurs in the HTTPUEContextTransfer handler where the absence of a default case in the Content-Type switch statement causes requests with unsupported Content-Type headers to bypass deserialization without error. Consequently, the processor operates on an uninitialized UeContextTransferRequest object. This flaw is addressed in free5GC AMF version 1.4.3.
Potential Impact
An attacker sending requests with unsupported Content-Type headers can cause the AMF component to process uninitialized data structures, potentially leading to unexpected behavior or logic errors. The CVSS 4.0 score of 5.5 reflects a medium impact with network attack vector, no privileges required, and limited integrity impact. There are no known exploits in the wild.
Mitigation Recommendations
Upgrade free5GC AMF to version 1.4.3 or later, where the issue is fixed by adding a default case to handle unsupported Content-Type headers properly. Patch status is not explicitly confirmed beyond the version fix note; therefore, verify with the vendor or project repository for the official patch and update guidance.
CVE-2026-41136: CWE-440: Expected Behavior Violation in free5gc amf
Description
CVE-2026-41136 is a medium severity vulnerability in free5GC AMF versions prior to 1. 4. 3. The issue arises because the HTTPUEContextTransfer handler lacks a default case for unsupported Content-Type headers, causing deserialization to be skipped silently and the processor to handle an uninitialized request object. This behavior violates expected processing logic and could lead to unexpected application behavior. A fix was introduced in version 1. 4. 3.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability in free5GC AMF occurs in the HTTPUEContextTransfer handler where the absence of a default case in the Content-Type switch statement causes requests with unsupported Content-Type headers to bypass deserialization without error. Consequently, the processor operates on an uninitialized UeContextTransferRequest object. This flaw is addressed in free5GC AMF version 1.4.3.
Potential Impact
An attacker sending requests with unsupported Content-Type headers can cause the AMF component to process uninitialized data structures, potentially leading to unexpected behavior or logic errors. The CVSS 4.0 score of 5.5 reflects a medium impact with network attack vector, no privileges required, and limited integrity impact. There are no known exploits in the wild.
Mitigation Recommendations
Upgrade free5GC AMF to version 1.4.3 or later, where the issue is fixed by adding a default case to handle unsupported Content-Type headers properly. Patch status is not explicitly confirmed beyond the version fix note; therefore, verify with the vendor or project repository for the official patch and update guidance.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-04-17T12:59:15.738Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 69e8135419fe3cd2cd08f850
Added to database: 4/22/2026, 12:16:20 AM
Last enriched: 4/22/2026, 12:31:02 AM
Last updated: 4/22/2026, 2:54:29 AM
Views: 7
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.