~ / search / GHSA-j478-p7vq-3347

GHSA-j478-p7vq-3347

Ella Core: AMF DoS via malformed PathSwitchRequest with empty NR security capability bitstrings

Source: GitHub Advisory Database (reviewed) Moderate CVE-2026-32320

Packages

EcosystemPackageAffectedFixed in
Go github.com/ellanetworks/core < 1.5.1 1.5.1

Details

As written in the advisory (Markdown source, shown as plain text).

## Summary Ella Core panics when processing a PathSwitchRequest containing UE Security Capabilities with zero-length NR encryption or integrity protection algorithm bitstrings, resulting in a denial of service. ## Impact An attacker able to send crafted NGAP messages to Ella Core can crash the process, causing service disruption for all connected subscribers. No authentication is required. ## Fix Added length validation on NR algorithm bitstrings before accessing them in the PathSwitchRequest handler.

References

External links from the advisory. They lead to third-party sites.