CVE-2026-33904
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk7th percentile - higher than 7% of all known CVEs
Summary
Ella Core prior to version 1.7.0 contains a deadlock in the AMF's SCTP notification handler that hangs the entire AMF control plane until the process is restarted. An attacker with access to the N2 interface can cause Ella Core to hang, resulting in a denial of service for all subscribers.
Risk Assessment
An attacker with access to the N2 interface can cause a denial of service (DoS) for all network subscribers.
Recommendation
Upgrade Ella Core to version 1.7.0. Restrict access to the N2 interface to trusted entities.
Other vulnerabilities in Ella Core
See all- CVE-2026-44475Medium
Ella Core, a 5G core designed for private networks, prior to 1.10.0 does not verify the UE Security Capabilities received in NGAP PathSwitchRequest messages against its locally stored values. A malicious gNB can overwrite Ella Core's stored UE security capabilities for any UE with arbitrary values by sending a single crafted PathSwitchRequest. This vulnerability is fixed in 1.10.0.
- CVE-2026-44474Low
Ella Core is a 5G core designed for private networks. Prior to 1.10.0, Ella Core didn't enforce security rules on concurrent running of security procedures defined in TS 33.501 §6.9.5.1 — it could send a NAS Security Mode Command while an N2 handover was still pending (and vice versa). Concurrent Security Mode Command and N2 handover produce a KgNB mismatch between the UE and target gNB, causing the handover to fail. This requires a stalled gNB and a re-registration race to trigger. The vulnerability is fixed in 1.10.0.
- CVE-2026-44473High
Ella Core, designed for private 5G networks, prior to version 1.10.0, allowed a radio with a valid NG Setup to send forged PDUSessionResourceSetupResponse messages. The system did not verify if the message arrived over the correct NG connection, leading to the creation of a GTP tunnel towards that radio.
- CVE-2026-34762Low
In Ella Core prior to version 1.8.0, the PUT /api/v1/subscriber/{imsi} API does not verify that the IMSI from the URL path matches the IMSI from the JSON request body. An authenticated NetworkManager can modify any subscriber's policy while the audit trail records a fabricated IMSI. This is fixed in version 1.8.0.
- CVE-2026-34761Medium
Ella Core, a 5G core for private networks, prior to version 1.8.0 panics when processing a NGAP handover failure message. An attacker can send such messages via gNodeB, causing service disruption for all connected subscribers.
- CVE-2026-33907Medium
Ella Core is a 5G core designed for private networks. Versions prior to 1.7.0 panic when processing Authentication Response and Authentication Failure NAS messages missing IEs. An attacker able to send crafted NAS messages can crash the process, causing service disruption for all connected subscribers. No authentication is required.
- CVE-2026-33903Medium
Ella Core, a 5G core designed for private networks, panics when processing a specially crafted NGAP LocationReport message in versions prior to 1.7.0. An attacker able to send such messages can crash the process.
Original NVD description (English source)
Ella Core is a 5G core designed for private networks. Prior to version 1.7.0, a deadlock in the AMF's SCTP notification handler causes the entire AMF control plane to hang until the process is restarted. An attacker with access to the N2 interface can cause Ella Core to hang, resulting in a denial of service for all subscribers. Version 1.7.0 adds deferred Radio cleanup in serveConn SCTP server so that every connection exit path removes the radio. Remove the stale-entry scan from SCTP Notification handling.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS