CVE-2026-41136

CVE-2026-41136 affects free5GC's AMF (Access & Mobility Management Function) component in versions prior to 1.4.3. The vulnerability exists in the HTTPUEContextTransfer handler, which fails to include a default case in its Content-Type switch statement. When requests arrive with unsupported Content-Type headers, the deserialization step is silently skipped, causing the processor to receive an uninitialized UeContextTransferRequest object instead of properly rejecting the request. The vulnerability presents a moderate risk profile with a FAUCET Risk Score of 33.0/100. While specific CVSS metrics are unavailable, the defect allows an unauthenticated attacker to send malformed requests that bypass input validation and deserialization controls. The potential impact includes denial of service, unexpected behavior, or potential information disclosure through processing of uninitialized data structures, though the exact consequences depend on downstream processing of the malformed object. This vulnerability is not currently listed on CISA's Known Exploited Vulnerabilities catalog and shows no signs of active exploitation. The EPSS score of 0.00039 indicates minimal real-world exploitation probability. The issue has received limited community attention, likely due to its specific nature within a niche 5G core network project. Users should apply the available patch in version 1.4.3 to remediate the defect.