GitHub Advisoryadvisory · Go

GHSA-q669-4gmv-g8mf Ella Core panics on invalid PDU Session IDs in NGAP messages

MEDIUM Published 2026-03-19 Modified 2026-03-25 Official page ↗
Aliases
CVE-2026-33281
Ecosystem
Go
Packages
github.com/ellanetworks/core
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-129
Reviewed
2026-03-19

Affected packages

• Go github.com/ellanetworks/core: < 1.6.0 → fixed in 1.6.0

Description

Summary Ella Core panics when processing NGAP messages with invalid PDU Session IDs outside of 1-15. Impact An attacker able to send crafted NGAP messages to Ella Core can crash the process, causing service disruption for all connected subscribers. No authentication is required. Fix Added PDU Session ID validations during NGAP message handling.

Related

Alias · CVE (1)

  • CVE-2026-33281 Ella Core is a 5G core designed for private networks. vulnerability

Weakness · CWE (1)

  • CWE-129 Improper Validation of Array Index weakness

References