EUVD-2026-24576
GHSA-r99v-75p9-xqm5
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from GitHub Advisory.
CVSS VectorGitHub Advisory
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
6DescriptionGitHub Advisory
free5GC AMF provides Access & Mobility Management Function (AMF) for free5GC, an an open-source project for 5th generation (5G) mobile core networks. Prior to version 1.4.3, the HTTPUEContextTransfer handler in internal/sbi/api_communication.go does not include a default case in the Content-Type switch statement. When a request arrives with an unsupported Content-Type, the deserialization step is silently skipped, err remains nil, and the processor is invoked with a completely uninitialized UeContextTransferRequest object. Version 1.4.3 contains a fix.
AnalysisAI
Improper error handling in free5GC AMF prior to version 1.4.3 allows remote attackers to invoke the HTTPUEContextTransfer handler with uninitialized request objects by sending requests with unsupported Content-Type headers. The missing default case in the Content-Type switch statement silently skips deserialization without raising an error, resulting in integrity loss when malformed or crafted payloads reach the processor with null/uninitialized state. CVSS score of 5.5 reflects low integrity impact; publicly available exploit code exists (E:P).
Technical ContextAI
free5GC AMF implements the Access & Mobility Management Function for 5th generation mobile networks following 3GPP specifications. The vulnerability exists in the HTTPUEContextTransfer handler within internal/sbi/api_communication.go, specifically in HTTP request deserialization logic. The handler uses a switch statement to dispatch Content-Type headers (e.g., application/json, application/3gppHal+json) to appropriate unmarshaling functions. CWE-440 (Expected Initialization) occurs because the absence of a default case causes the handler to proceed without validating that deserialization succeeded. When an unsupported Content-Type arrives, the error variable remains nil despite the UeContextTransferRequest struct being uninitialized, allowing downstream processor code to operate on default/zero-valued struct fields rather than rejecting the malformed input. This is a classic input validation flaw where the control flow assumes successful deserialization without explicit confirmation.
RemediationAI
Upgrade free5GC AMF to version 1.4.3 or later, which includes the fix by adding a proper default case to the Content-Type switch statement that returns an error for unsupported content types. This forces explicit validation of Content-Type support before deserialization proceeds. For deployments unable to immediately patch, implement network-level access controls restricting UE context transfer requests to trusted peer AMF or mobility management entities, blocking external/untrusted sources from sending HTTPUEContextTransfer messages. Additionally, configure logging and alerting on Content-Type validation failures to detect exploit attempts. These mitigations reduce exposure but do not fully resolve the flaw; patching remains the primary remediation. Verify the upgrade by confirming the presence of the Content-Type validation logic in the deployed version.
free5GC is an open-source project for 5th generation (5G) mobile core networks. Versions up to and including 1.4.1 of fr
Denial of service in omec-project AMF (Access and Mobility Management Function) versions up to 2.1.1 allows a low-privil
Denial of service in omec-project's 5G Access and Mobility Management Function (AMF) versions up to 2.0.2 and 2.1.1 allo
Null pointer dereference in OMEC Project AMF (Access and Mobility Management Function) versions up to 2.1.3-dev allows a
Remote denial of service in omec-project AMF versions up to 2.1.3-dev allows authenticated attackers to crash the Access
Null pointer dereference in OMEC Project AMF versions up to 2.1.3-dev allows remote authenticated attackers to trigger d
Memory corruption in OMEC Project AMF (Access and Mobility Management Function) versions up to 2.1.1 allows authenticate
Memory corruption in the omec-project AMF (Access and Mobility Management Function) NGSetupRequest Handler allows networ
Memory corruption in omec-project AMF versions up to 2.1.1 exposes 5G core network infrastructure to remote exploitation
Memory corruption in omec-project AMF (Access and Mobility Management Function) through version 2.1.1 allows authenticat
Memory corruption in omec-project AMF versions up to 2.1.3-dev allows authenticated remote attackers to trigger low-seve
Memory corruption in OMEC Project's Access and Mobility Management Function (AMF) allows authenticated remote attackers
Same weakness CWE-440 – Expected Behavior Violation
View allSame technique Deserialization
View allVendor StatusVendor
SUSE
Severity: Moderate| Product | Status |
|---|---|
| SUSE Linux Enterprise Server 16.1 | Affected |
| SUSE Linux Enterprise Server for SAP applications 16.1 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP5 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP6 | Affected |
| openSUSE Leap 15.5 | Affected |
| openSUSE Leap 15.6 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today