CVE-2026-32320CWE-125

Ella Core: AMF DoS via malformed PathSwitchRequest with empty NR security capability bitstrings

Medium · published March 12, 2026

CVSS v3.1
6.5
EPSS
0%
Percentile
24.5
In the wild
Unconfirmed
What it is

Ella Core is a 5G core designed for private networks. Prior to 1.5.1, Ella Core panics when processing a PathSwitchRequest containing UE Security Capabilities with zero-length NR encryption or integrity protection algorithm bitstrings, resulting in a denial of service. An attacker able to send crafted NGAP messages to Ella Core can crash the process, causing service disruption for all connected subscribers. No authentication is required. This vulnerability is fixed in 1.5.1.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00327 · 24.5th percentile
Weakness
CWE-125 · Out-of-bounds Read
Published
2026-03-12T21:34Z
EPSS history
Timeline
  • 12 MAR 21:34Z
    Ella Core: AMF DoS via malformed PathSwitchRequest with empty NR security capability bitstrings
    cvelistv5