GitHub Advisoryadvisory · Go

GHSA-826q-wrq4-p23x Ella Core panics on malformed NGAP Location Report

HIGH Published 2026-03-19 Modified 2026-03-25 Official page ↗
Aliases
CVE-2026-33282
Ecosystem
Go
Packages
github.com/ellanetworks/core
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-476
Reviewed
2026-03-19

Affected packages

• Go github.com/ellanetworks/core: < 1.6.0 → fixed in 1.6.0

Description

Summary Ella Core panics when processing a malformed NGAP LocationReport message with `ue-presence-in-area-of-interest` event type and omitting the optional `UEPresenceInAreaOfInterestList` IE. Impact An attacker able to send crafted NGAP messages to Ella Core can crash the process, causing service disruption for all connected subscribers. No authentication is required. Fix Added IE presence verification to NGAP message handling.

Related

Alias · CVE (1)

  • CVE-2026-33282 Ella Core is a 5G core designed for private networks. vulnerability

Weakness · CWE (1)

  • CWE-476 NULL Pointer Dereference weakness

References