ellanetworks/core · Security
Ella Core panics when processing a crafted NGAP LocationReport message
- GHSA ID
- GHSA-f2f3-9cx3-wcmf
- CVE ID
- CVE-2026-33903
- Severity
- medium
- Published
- Updated
- CVSS
- 6.5 · CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- CVSS v3
- 6.5 · CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Description
Summary
Ella Core panics when processing a specially crafted NGAP LocationReport message.
Impact
An attacker able to send crafted NGAP messages to Ella Core can crash the process, causing service disruption for all connected subscribers.
Fix
Add guards in NGAP Location Report handler.
CWEs
- CWE-476 · NULL Pointer Dereference
References
- https://github.com/ellanetworks/core/security/advisories/GHSA-f2f3-9cx3-wcmf ↗
- https://github.com/ellanetworks/core/commit/ec77a2ad4508f8488cb356fd45b2f1efd92587f8 ↗
- https://github.com/ellanetworks/core/releases/tag/v1.7.0 ↗
- https://nvd.nist.gov/vuln/detail/CVE-2026-33903 ↗
- https://github.com/advisories/GHSA-f2f3-9cx3-wcmf ↗