# CVE-2026-41136: free5GC AMF: Missing default case in Content-Type switch in HTTPUEContextTransfer

Source: https://junglewise.ai/threats/cve-2026-41136-free5gc-amf-missing-default-case-in-content-type-switch-in  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-22. Updated: 2026-05-11  
License: CC BY 4.0 with a link back

CVE-2026-41136 · Severity: medium · CVSS 5.3 · Published 2026-04-22

free5GC AMF provides Access & Mobility Management Function (AMF) for free5GC, an an open-source project for 5th generation (5G) mobile core networks. Prior to version 1.4.3, the `HTTPUEContextTransfer` handler in `internal/sbi/api_communication.go` does not include a `default` case in the `Content-Type` switch statement. When a request arrives with an unsupported `Content-Type`, the deserialization step is silently skipped, `err` remains `nil`, and the processor is invoked with a completely uninitialized `UeContextTransferRequest` object. Version 1.4.3 contains a fix.

Technologies: [free5GC](https://junglewise.ai/threats/technologies/free5gc), [github.com/free5gc/amf (Go)](https://junglewise.ai/threats/technologies/github-com-free5gc-amf). Vendors: [free5GC](https://junglewise.ai/threats/vendors/free5gc), [Go](https://junglewise.ai/threats/vendors/go).

## Quick answers

**Is CVE-2026-41136 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-41136 being exploited in the wild.

**How severe is CVE-2026-41136?** Medium severity, with a CVSS score of 5.3, published 22 April 2026.

**Which products and versions are affected?** github.com/free5gc/amf (Go) <= 1.4.3, SEMVER:introduced=0, SEMVER:introduced=0,last_affected=1.4.3.

**Is there a fix for CVE-2026-41136?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**Am I affected by CVE-2026-41136?** Check whether you run free5GC Amf, free5GC or github.com/free5gc/amf (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Affected products

- free5GC Amf
- free5GC
- github.com/free5gc/amf (Go) <= 1.4.3, SEMVER:introduced=0, SEMVER:introduced=0,last_affected=1.4.3

## Identifiers

- CVE-2026-41136
- GHSA-r99v-75p9-xqm5
- GO-2026-5613

## References

- [https://api.github.com/users/Giancannella](https://api.github.com/users/Giancannella)
- [https://github.com/Giancannella](https://github.com/Giancannella)
- [https://api.github.com/users/Giancannella/gists%7B/gist_id%7D](https://api.github.com/users/Giancannella/gists%7B/gist_id%7D)
- [https://api.github.com/users/Giancannella/repos](https://api.github.com/users/Giancannella/repos)
- [https://avatars.githubusercontent.com/u/56028149?v=4](https://avatars.githubusercontent.com/u/56028149?v=4)
- [https://api.github.com/users/Giancannella/events%7B/privacy%7D](https://api.github.com/users/Giancannella/events%7B/privacy%7D)

## Related threats

- [Free5GC SMF resource exhaustion in PFCP session establishment](https://junglewise.ai/threats/cve-2026-106805-a-resource-exhaustion-issue-exists-in-free5gc-v4-2-3-during-pfcp)
- [Free5GC race condition in GMM handler RanUe context access](https://junglewise.ai/threats/cve-2026-94043-a-vulnerability-was-determined-in-free5gc-up-to-4-2-3-this)
- [Free5GC UPF nil pointer dereference in PFCP Session Report](https://junglewise.ai/threats/cve-2026-75439-free5gc-upf-nil-pointer-dereference-in-pfcp-session-report)
- [free5GC NRF input validation bypass in NF profile registration](https://junglewise.ai/threats/cve-2026-55068-free5gc-nrf-input-validation-bypass-in-nf-profile-registration)
- [free5gc NSSF nil pointer dereference in NssaiAvailabilitySubscriptionCreate](https://junglewise.ai/threats/cve-2026-30073-free5gc-nssf-nil-pointer-dereference-in)