medium6.5
CVE-2026-33281
Ella Core panics on invalid PDU Session IDs in NGAP messages
Impact
## Summary Ella Core panics when processing NGAP messages with invalid PDU Session IDs outside of 1-15. ## Impact An attacker able to send crafted NGAP messages to Ella Core can crash the process, causing service disruption for all connected subscribers. No authentication is required. ## Fix Added PDU Session ID validations during NGAP message handling.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| go | github.com/ellanetworks/core | < 1.6.0 | 1.6.0 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Ellanetworks | Ella Core | before 1.6.0 |