Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
free5GC AMF provides Access & Mobility Management Function (AMF) for free5GC, an an open-source project for 5th generation (5G) mobile core networks. Prior to version 1.4.3, the `HTTPUEContextTransfer` handler in `internal/sbi/api_communication.go` does not include a `default` case in the `Content-Type` switch statement. When a request arrives with an unsupported `Content-Type`, the deserialization step is silently skipped, `err` remains `nil`, and the processor is invoked with a completely uninitialized `UeContextTransferRequest` object. Version 1.4.3 contains a fix.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
NONE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-04-22 | 1 | Disclosure1 |
| 2026-04-25 | 1 | General1 |
CVE-2026-41136 free5GC AMF provides Access & Mobility Management Function (AMF) for free5GC, an an open-source project for 5th generation (5G) mobile core networks. Prior to version… https://www.cve.org/CVERecord?id=CVE-2026-41136
Post summary
The text merely references CVE-2026-41136 with a link to its CVE record, offering no further detail on exploitation, mitigation, or technical specifics.
CVE-2026-41136 Uninitialized Object Deserialization in free5GC AMF Prior to Version 1.4.3 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-41136
Post summary
The text reports a new CVE (CVE-2026-41136) describing uninitialized object deserialization in free5GC AMF versions prior to 1.4.3, with no proof of exploitation, tooling, or available patches mentioned.
2 of 2 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | free5gc | amf | - | go | - |
| App | free5gc | free5gc | - | - | - |