GHSA-55q8-2gwx-29pc

Ella Core Panics during NAS Authentication Response/Failure with missing IEs

Source: GitHub Advisory Database (reviewed) Moderate CVE-2026-33907

Packages

Ecosystem	Package	Affected	Fixed in
Go	github.com/ellanetworks/core	< 1.7.0	1.7.0

Details

As written in the advisory (Markdown source, shown as plain text).

## Summary Ella Core panics when processing Authentication Response and Authentication Failure NAS message missing IEs. ## Impact An attacker able to send crafted NAS messages to Ella Core can crash the process, causing service disruption for all connected subscribers. No authentication is required. ## Fix Added IE presence verification to NAS message handling.

References

External links from the advisory. They lead to third-party sites.

https://github.com/ellanetworks/core/security/advisories/GHSA-55q8-2gwx-29pc web
https://nvd.nist.gov/vuln/detail/CVE-2026-33907 advisory
https://github.com/ellanetworks/core/commit/52962660e3bd3e23c7e96b0da270ac1e0e705273 web
https://github.com/ellanetworks/core package
https://github.com/ellanetworks/core/releases/tag/v1.7.0 web