GitHub Advisoryadvisory · Go

GHSA-m9pm-w3gv-c68f Ella Core vulnerable to Unauthenticated AMF DoS via malformed InitialUEMessage with undersized integrity-protected NAS payload

HIGH Published 2026-03-12 Modified 2026-03-16 Official page ↗
Aliases
CVE-2026-32319
Ecosystem
Go
Packages
github.com/ellanetworks/core
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-125
Reviewed
2026-03-12

Affected packages

• Go github.com/ellanetworks/core: < 1.5.1 → fixed in 1.5.1

Description

Summary Ella Core panics when processing a malformed integrity protected NGAP/NAS message with a length under 7 bytes. Impact An attacker able to send crafted NAS messages to Ella Core can crash the process, causing service disruption for all connected subscribers. No authentication is required. Fix Added length verification to NAS message handling.

Related

Alias · CVE (1)

  • CVE-2026-32319 Ella Core is a 5G core designed for private networks. vulnerability

Weakness · CWE (1)

  • CWE-125 Out-of-bounds Read weakness

References