CVE-2026-41136: 
NixOS vulnerability analysis and mitigation

CVE-2026-41136 is an Expected Behavior Violation (CWE-440) in the free5GC Access & Mobility Management Function (AMF) component, specifically in the HTTPUEContextTransfer handler. The vulnerability affects free5GC AMF versions prior to 1.4.3 (and free5gc versions up to and including 4.2.1). It was published on April 21, 2026, with a fix released the same day. The CVSS v3.1 base score is 5.3 (Medium), and the CVSS v4.0 base score is 5.5 (Medium) (Github Advisory, free5gc Advisory).

The root cause is a missing default case in the Content-Type switch statement within the HTTPUEContextTransfer handler in internal/sbi/api_communication.go. The switch only handles application/json and multipart/related; when any other Content-Type is received, the deserialization step is silently skipped, err remains nil, and the downstream processor (HandleUEContextTransferRequest) is invoked with a completely uninitialized UeContextTransferRequest struct. This is inconsistent with the analogous handlers HTTPCreateUEContext and HTTPN1N2MessageTransfer in the same file, which both include a correct default: err = fmt.Errorf("wrong content type") branch. The fix requires adding the same default case to HTTPUEContextTransfer (free5gc Advisory).

An unauthenticated attacker with access to the internal 5G Core (5GC) Service-Based Interface (SBI) network can send a crafted POST request with an unsupported Content-Type to the UE context transfer endpoint, causing the processor to be invoked with an empty request object. The immediate impact is limited to a low integrity effect — the processor's secondary mandatory field validation currently prevents unintended UE context state modification, resulting in a MANDATORY_IE_MISSING error response rather than actual data corruption. However, the vulnerability violates defense-in-depth principles: any future relaxation of the processor's validation logic could expose the system to processing fully uninitialized request objects, potentially affecting AMF-to-AMF UE context handover operations (free5gc Advisory, Github Advisory).

A proof-of-concept exploit is publicly available in the official security advisory, consisting of a simple curl command targeting the /namf-comm/v1/ue-contexts/<ueContextId>/transfer endpoint with an unsupported Content-Type: text/plain header. There is no evidence of in-the-wild exploitation at this time, and no threat actor attribution has been reported. The EPSS score is approximately 0.039% (0.000390), placing it in a low exploitation probability tier. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires access to the internal 5GC SBI network, which is not directly reachable from external UEs, significantly limiting the attacker population (Github Advisory, free5gc Advisory).

1. Reconnaissance: Identify a free5GC deployment running AMF version prior to 1.4.3 with access to the internal 5GC SBI network (e.g., via a compromised internal host or misconfigured network boundary).
2. Identify the target endpoint: Locate the UE context transfer SBI API endpoint at /namf-comm/v1/ue-contexts/<ueContextId>/transfer on the AMF's SBI interface IP and port.
3. Craft the malicious request: Prepare an HTTP POST request with an unsupported Content-Type header (e.g., text/plain) and any arbitrary body payload.
4. Send the request: Execute the request using a tool such as curl:

   curl -s -X POST "http://<AMF_IP>/namf-comm/v1/ue-contexts/<ueContextId>/transfer" \
     -H "Content-Type: text/plain" \
     -d '{"test":"data"}' \
     -i

5. Observe the behavior: The SBI handler skips deserialization and invokes the processor with an uninitialized struct. The response will be HTTP/1.1 400 Bad Request with {"status": 400, "cause": "MANDATORY_IE_MISSING"}, confirming the processor was reached — bypassing the intended SBI-layer rejection (free5gc Advisory).

• Network: Unexpected HTTP POST requests to /namf-comm/v1/ue-contexts/*/transfer on the AMF SBI interface with Content-Type values other than application/json or multipart/related (e.g., text/plain, application/xml).
• Logs: AMF access logs showing POST requests to the UE context transfer endpoint returning 400 Bad Request with cause MANDATORY_IE_MISSING from sources not corresponding to known peer AMF nodes; repeated such requests from a single source IP may indicate probing.
• Process/Application: AMF application logs indicating the HandleUEContextTransferRequest processor was invoked without a preceding successful deserialization step.

The primary remediation is to upgrade free5GC AMF to version 1.4.3 or later, which adds the missing default case to the HTTPUEContextTransfer Content-Type switch statement (AMF Release v1.4.3). As a network-level workaround, restrict access to the AMF SBI interface (/namf-comm/v1/ue-contexts/*/transfer) to trusted peer AMF nodes only, using firewall rules or network segmentation to prevent unauthorized access to the internal 5GC SBI network. Additionally, monitor for requests with unsupported Content-Type values targeting this endpoint as a detection measure (free5gc Advisory).

The vulnerability was reported by security researcher Giancannella and published by the free5GC maintainer Alonza0314 on April 21, 2026. The advisory characterizes the severity as low, noting that the processor's secondary validation currently prevents actual exploitation, but flags the defense-in-depth concern. No significant broader media coverage or notable community commentary beyond the official advisory has been identified (free5gc Advisory).