CVE-2026-33903

Ella Core, a 5G core designed for private networks, prior to 1.10.0 does not verify the UE Security Capabilities received in NGAP PathSwitchRequest messages against its locally stored values. A malicious gNB can overwrite Ella Core's stored UE security capabilities for any UE with arbitrary values by sending a single crafted PathSwitchRequest. This vulnerability is fixed in 1.10.0.

Ella Core is a 5G core designed for private networks. Prior to 1.10.0, Ella Core didn't enforce security rules on concurrent running of security procedures defined in TS 33.501 §6.9.5.1 — it could send a NAS Security Mode Command while an N2 handover was still pending (and vice versa). Concurrent Security Mode Command and N2 handover produce a KgNB mismatch between the UE and target gNB, causing the handover to fail. This requires a stalled gNB and a re-registration race to trigger. The vulnerability is fixed in 1.10.0.

Ella Core, designed for private 5G networks, prior to version 1.10.0, allowed a radio with a valid NG Setup to send forged PDUSessionResourceSetupResponse messages. The system did not verify if the message arrived over the correct NG connection, leading to the creation of a GTP tunnel towards that radio.

In Ella Core prior to version 1.8.0, the PUT /api/v1/subscriber/{imsi} API does not verify that the IMSI from the URL path matches the IMSI from the JSON request body. An authenticated NetworkManager can modify any subscriber's policy while the audit trail records a fabricated IMSI. This is fixed in version 1.8.0.

Ella Core, a 5G core for private networks, prior to version 1.8.0 panics when processing a NGAP handover failure message. An attacker can send such messages via gNodeB, causing service disruption for all connected subscribers.

Ella Core is a 5G core designed for private networks. Versions prior to 1.7.0 panic when processing Authentication Response and Authentication Failure NAS messages missing IEs. An attacker able to send crafted NAS messages can crash the process, causing service disruption for all connected subscribers. No authentication is required.

Ella Core prior to version 1.7.0 contains a deadlock in the AMF's SCTP notification handler that hangs the entire AMF control plane until the process is restarted. An attacker with access to the N2 interface can cause Ella Core to hang, resulting in a denial of service for all subscribers.