GitHub Advisoryadvisory · Go

GHSA-f2f3-9cx3-wcmf Ella Core panics when processing a crafted NGAP LocationReport message

MEDIUM Published 2026-03-26 Modified 2026-03-27 Official page ↗
Aliases
CVE-2026-33903
Ecosystem
Go
Packages
github.com/ellanetworks/core
Severity
Moderate
CVSS vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-476
Reviewed
2026-03-26

Affected packages

• Go github.com/ellanetworks/core: < 1.7.0 → fixed in 1.7.0

Description

Summary Ella Core panics when processing a specially crafted NGAP LocationReport message. Impact An attacker able to send crafted NGAP messages to Ella Core can crash the process, causing service disruption for all connected subscribers. Fix Add guards in NGAP Location Report handler.

Related

Alias · CVE (1)

  • CVE-2026-33903 Ella Core is a 5G core designed for private networks. vulnerability

Weakness · CWE (1)

  • CWE-476 NULL Pointer Dereference weakness

References