EUVD-2026-292382

fkie_cve-2026-41136

free5GC AMF provides Access & Mobility Management Function (AMF) for free5GC, an an open-source project for 5th generation (5G) mobile core networks. Prior to version 1.4.3, the `HTTPUEContextTransfer` handler in `internal/sbi/api_communication.go` does not include a `default` case in the `Content-Type` switch statement. When a request arrives with an unsupported `Content-Type`, the deserialization step is silently skipped, `err` remains `nil`, and the processor is invoked with a completely uninitialized `UeContextTransferRequest` object. Version 1.4.3 contains a fix.

GHSA-r99v-75p9-xqm5 — free5GC AMF: Missing default case in Content-Type switch in HTTPUEContextTransfer

Affected: Go: github.com/free5gc/amf

## Summary

The `HTTPUEContextTransfer` handler in `internal/sbi/api_communication.go` does not include a `default` case in the `Content-Type` switch statement. When a request arrives with an unsupported `Content-Type`, the deserialization step is silently skipped, `err` remains `nil`, and the processor is invoked with a completely uninitialized `UeContextTransferRequest` object.

## Details

In `internal/sbi/api_communication.go`, the `HTTPUEContextTransfer` function handles the `Content-Type` header with a switch statement that only covers `application/json` and `multipart/related`:

```go switch str[0] { case applicationjson: err = openapi.Deserialize(ueContextTransferRequest.JsonData, requestBody, contentType) case multipartrelate: err = openapi.Deserialize(&ueContextTransferRequest, requestBody, contentType) // no default case }

if err != nil { // skipped entirely when Content-Type is unsupported c.JSON(http.StatusBadRequest, rsp) return }

s.Processor().HandleUEContextTransferRequest(c, ueContextTransferRequest) ```

This is inconsistent with the two analogous handlers in the same file, `HTTPCreateUEContext` and `HTTPN1N2MessageTransfer`, which both correctly include a `default` branch:

```go default: err = fmt.Errorf("wrong content type") ```

The fix is simply to add the same `default` case to `HTTPUEContextTransfer`.

## PoC

With a free5GC deployment running, send a POST request to the UE context transfer endpoint using any unsupported `Co…

Most recent entries from all

EUVD-2026-292382

fkie_cve-2026-41136

GHSA-r99v-75p9-xqm5 — free5GC AMF: Missing default case in Content-Type switch in HTTPUEContextTransfer