~ / search / GHSA-826q-wrq4-p23x

GHSA-826q-wrq4-p23x

Ella Core panics on malformed NGAP Location Report

Source: GitHub Advisory Database (reviewed) High CVE-2026-33282

Packages

EcosystemPackageAffectedFixed in
Go github.com/ellanetworks/core < 1.6.0 1.6.0

Details

As written in the advisory (Markdown source, shown as plain text).

## Summary Ella Core panics when processing a malformed NGAP LocationReport message with `ue-presence-in-area-of-interest` event type and omitting the optional `UEPresenceInAreaOfInterestList` IE. ## Impact An attacker able to send crafted NGAP messages to Ella Core can crash the process, causing service disruption for all connected subscribers. No authentication is required. ## Fix Added IE presence verification to NGAP message handling.

References

External links from the advisory. They lead to third-party sites.