CVE-2026-44474
LowCVSS 3.7Exploitation Probability (EPSS)
Low risk3th percentile - higher than 3% of all known CVEs
Summary
Ella Core is a 5G core designed for private networks. Prior to 1.10.0, Ella Core didn't enforce security rules on concurrent running of security procedures defined in TS 33.501 §6.9.5.1 — it could send a NAS Security Mode Command while an N2 handover was still pending (and vice versa). Concurrent Security Mode Command and N2 handover produce a KgNB mismatch between the UE and target gNB, causing the handover to fail. This requires a stalled gNB and a re-registration race to trigger. The vulnerability is fixed in 1.10.0.
Risk Assessment
It is possible to disrupt the N2 handover procedure in a 5G network, potentially leading to denial of service or network malfunction. Exploitation requires specific conditions (stalled gNB and re-registration race).
Recommendation
Update Ella Core to version 1.10.0 or later. Additionally, monitor the network for unusual behavior related to security procedures.
Other vulnerabilities in Ella Core
See all- CVE-2026-44475Medium
Ella Core, a 5G core designed for private networks, prior to 1.10.0 does not verify the UE Security Capabilities received in NGAP PathSwitchRequest messages against its locally stored values. A malicious gNB can overwrite Ella Core's stored UE security capabilities for any UE with arbitrary values by sending a single crafted PathSwitchRequest. This vulnerability is fixed in 1.10.0.
- CVE-2026-44473High
Ella Core, designed for private 5G networks, prior to version 1.10.0, allowed a radio with a valid NG Setup to send forged PDUSessionResourceSetupResponse messages. The system did not verify if the message arrived over the correct NG connection, leading to the creation of a GTP tunnel towards that radio.
- CVE-2026-34762Low
In Ella Core prior to version 1.8.0, the PUT /api/v1/subscriber/{imsi} API does not verify that the IMSI from the URL path matches the IMSI from the JSON request body. An authenticated NetworkManager can modify any subscriber's policy while the audit trail records a fabricated IMSI. This is fixed in version 1.8.0.
- CVE-2026-34761Medium
Ella Core, a 5G core for private networks, prior to version 1.8.0 panics when processing a NGAP handover failure message. An attacker can send such messages via gNodeB, causing service disruption for all connected subscribers.
- CVE-2026-33907Medium
Ella Core is a 5G core designed for private networks. Versions prior to 1.7.0 panic when processing Authentication Response and Authentication Failure NAS messages missing IEs. An attacker able to send crafted NAS messages can crash the process, causing service disruption for all connected subscribers. No authentication is required.
- CVE-2026-33904Medium
Ella Core prior to version 1.7.0 contains a deadlock in the AMF's SCTP notification handler that hangs the entire AMF control plane until the process is restarted. An attacker with access to the N2 interface can cause Ella Core to hang, resulting in a denial of service for all subscribers.
- CVE-2026-33903Medium
Ella Core, a 5G core designed for private networks, panics when processing a specially crafted NGAP LocationReport message in versions prior to 1.7.0. An attacker able to send such messages can crash the process.
Original NVD description (English source)
Ella Core is a 5G core designed for private networks. Prior to 1.10.0, Ella Core didn't enforce security rules on concurrent running of security procedures defined in TS 33.501 §6.9.5.1 — it could send a NAS Security Mode Command while an N2 handover was still pending (and vice versa). Concurrent Security Mode Command and N2 handover produce a KgNB mismatch between the UE and target gNB, causing the handover to fail. Requires a stalled gNB + re-registration race to trigger. This vulnerability is fixed in 1.10.0.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS