GitHub Advisoryadvisory · Go

GHSA-pwfh-mqp3-pqwj Ella Core has a UE Security Capability bypass on NGAP PathSwitchRequest

MEDIUM Published 2026-05-11 Modified 2026-06-08 Official page ↗
Aliases
CVE-2026-44475
Ecosystem
Go
Packages
github.com/ellanetworks/core
Severity
Moderate
CVSS vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:L
Weaknesses
CWE-358
Reviewed
2026-05-11

Affected packages

• Go github.com/ellanetworks/core: < 1.10.0 → fixed in 1.10.0

Description

Summary Ella Core does not verify the UE Security Capabilities received in NGAP PathSwitchRequest messages against its locally stored values. A malicious gNB can overwrite Ella Core's stored UE security capabilities for any UE with arbitrary values by sending a single crafted PathSwitchRequest. Impact A gNB can corrupt Ella Core's stored UE security capabilities for a target UE. Fix The PathSwitchRequest handler now compares the received UE Security Capabilities against Ella Core's locally stored values, preserves the stored values on mismatch, returns them in the PathSwitchRequestAcknowledge, and logs the event.

Related

Alias · CVE (1)

  • CVE-2026-44475 Ella Core is a 5G core designed for private networks. vulnerability

Weakness · CWE (1)

  • CWE-358 Improperly Implemented Security Check for Standard weakness

References