Vulnerability in Ella Core 5G Core for Private Networks
CVE-2026-33281

6.5MEDIUM

Key Information:

Vendor

Ellanetworks

Status
Core
Vendor
CVE Published:
23 March 2026

What is CVE-2026-33281?

Ella Core, a 5G core solution designed for private networks, is vulnerable to improper input validation when processing NGAP messages containing invalid PDU Session IDs. Versions earlier than 1.6.0 are affected, allowing an attacker to exploit this vulnerability by sending specially crafted NGAP messages. This can lead to a crash of the service, resulting in a disruption for all connected users. To mitigate this issue, version 1.6.0 introduces crucial validations for PDU Session IDs during NGAP message handling, enhancing the overall security of the system.

Affected Version(s)

core < 1.6.0

References

https://github.com/ellanetworks/core/security/advisories/...
x_refsource_CONFIRM

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.