CVE-2026-41136

The record

free5GC AMF provides Access & Mobility Management Function (AMF) for free5GC, an an open-source project for 5th generation (5G) mobile core networks. Prior to version 1.4.3, the `HTTPUEContextTransfer` handler in `internal/sbi/api_communication.go` does not include a `default` case in the `Content-Type` switch statement. When a request arrives with an unsupported `Content-Type`, the deserialization step is silently skipped, `err` remains `nil`, and the processor is invoked with a completely uninitialized `UeContextTransferRequest` object. Version 1.4.3 contains a fix.

Affected packages

Related vulnerabilities

• CVE-2026-97687 urllib3 is an HTTP client library for Python. CWE-440
• CVE-2026-35191 Issue summary: The OpenSSL QUIC server, when configured to not preform address… CWE-440
• CVE-2026-16769 An unencrypted 'pause encryption request' message causes a denial of service in the in… CWE-440
• CVE-2026-65934 An unencrypted 'pause encryption request' message causes a denial of service in the BT122… CWE-440
• CVE-2026-65932 The BT122 module stops advertising after receiving a plaintext 'pause enceryption… CWE-440
• CVE-2026-8806 Expected Behavior Violation vulnerability in Mitsubishi Electric MELSEC iQ-F Series… CWE-440
• CVE-2026-42752 Unauthenticated Bypass Vulnerability in Stripe Payments <= 2.0.98 versions. CWE-440
• CVE-2026-49316 Expected behavior violation in the in-vehicle network of the Indian Motorcycle Scout… CWE-440