~ / search / GHSA-q669-4gmv-g8mf

GHSA-q669-4gmv-g8mf

Ella Core panics on invalid PDU Session IDs in NGAP messages

Source: GitHub Advisory Database (reviewed) Moderate CVE-2026-33281

Packages

EcosystemPackageAffectedFixed in
Go github.com/ellanetworks/core < 1.6.0 1.6.0

Details

As written in the advisory (Markdown source, shown as plain text).

## Summary Ella Core panics when processing NGAP messages with invalid PDU Session IDs outside of 1-15. ## Impact An attacker able to send crafted NGAP messages to Ella Core can crash the process, causing service disruption for all connected subscribers. No authentication is required. ## Fix Added PDU Session ID validations during NGAP message handling.

References

External links from the advisory. They lead to third-party sites.