CVE-2026-33281CWE-129

Ella Core panics on invalid PDU Session IDs in NGAP messages

Medium · published March 23, 2026

CVSS v3.1
6.5
EPSS
1%
Percentile
43.3
In the wild
Unconfirmed
What it is

Ella Core is a 5G core designed for private networks. Versions prior to 1.6.0 panic when processing NGAP messages with invalid PDU Session IDs outside of 1-15. An attacker able to send crafted NGAP messages to Ella Core can crash the process, causing service disruption for all connected subscribers. No authentication is required. Version 1.6.0 added PDU Session ID validations during NGAP message handling.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00519 · 43.3th percentile
Weakness
CWE-129 · Improper Validation of Array Index
Published
2026-03-23T23:46Z
EPSS history
Timeline
  • 23 MAR 23:46Z
    Ella Core panics on invalid PDU Session IDs in NGAP messages
    cvelistv5