~ / search / GHSA-3366-gw57-fcm5

GHSA-3366-gw57-fcm5

Ella Core panics on malformed ULNASTransport Message without a Request Type

Source: GitHub Advisory Database (reviewed) Moderate CVE-2026-33283

Packages

EcosystemPackageAffectedFixed in
Go github.com/ellanetworks/core < 1.6.0 1.6.0

Details

As written in the advisory (Markdown source, shown as plain text).

## Summary Ella Core panics when processing malformed UL NAS Transport NAS messages without a Request Type. ## Impact An attacker able to send crafted NAS messages to Ella Core can crash the process, causing service disruption for all connected subscribers. No authentication is required. ## Fix Add a guard when receiving an UL NAS Message without a Request Type given no SM Context.

References

External links from the advisory. They lead to third-party sites.