GitHub Advisoryadvisory · Go

GHSA-3366-gw57-fcm5 Ella Core panics on malformed ULNASTransport Message without a Request Type

MEDIUM Published 2026-03-19 Modified 2026-03-25 Official page ↗
Aliases
CVE-2026-33283
Ecosystem
Go
Packages
github.com/ellanetworks/core
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-476
Reviewed
2026-03-19

Affected packages

• Go github.com/ellanetworks/core: < 1.6.0 → fixed in 1.6.0

Description

Summary Ella Core panics when processing malformed UL NAS Transport NAS messages without a Request Type. Impact An attacker able to send crafted NAS messages to Ella Core can crash the process, causing service disruption for all connected subscribers. No authentication is required. Fix Add a guard when receiving an UL NAS Message without a Request Type given no SM Context.

Related

Alias · CVE (1)

  • CVE-2026-33283 Ella Core is a 5G core designed for private networks. vulnerability

Weakness · CWE (1)

  • CWE-476 NULL Pointer Dereference weakness

References