~ / search / GHSA-m9pm-w3gv-c68f

GHSA-m9pm-w3gv-c68f

Ella Core vulnerable to Unauthenticated AMF DoS via malformed InitialUEMessage with undersized integrity-protected NAS payload

Source: GitHub Advisory Database (reviewed) High CVE-2026-32319

Packages

EcosystemPackageAffectedFixed in
Go github.com/ellanetworks/core < 1.5.1 1.5.1

Details

As written in the advisory (Markdown source, shown as plain text).

## Summary Ella Core panics when processing a malformed integrity protected NGAP/NAS message with a length under 7 bytes. ## Impact An attacker able to send crafted NAS messages to Ella Core can crash the process, causing service disruption for all connected subscribers. No authentication is required. ## Fix Added length verification to NAS message handling.

References

External links from the advisory. They lead to third-party sites.