VulnerabilityAnalyzed

CVE-2026-34761

An attacker able to cause a gNodeB to send NGAP handover failure messages to Ella Core can crash the process, causing service disruption for all connected subscribers.

MEDIUM 6.5EPSS 0.32%

Does this matter?

Lower severity and a low EPSS score (0.32%). Track it; it rarely justifies an emergency change on its own.

Description

Ella Core is a 5G core designed for private networks. Prior to version 1.8.0, Ella Core panics when processing a NGAP handover failure message. An attacker able to cause a gNodeB to send NGAP handover failure messages to Ella Core can crash the process, causing service disruption for all connected subscribers. This issue has been patched in version 1.8.0.

CVSS 3.1: 6.5 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
EPSS: 0.32% probability · 24th percentile
CISA KEV: Not listed
Weakness: CWE-476
Affected: ellanetworks/ella core
Source: security-advisories@github.com

References

https://github.com/ellanetworks/core/releases/tag/v1.8.0Release Notes
https://github.com/ellanetworks/core/security/advisories/GHSA-6gm8-3g4h-w82mVendor Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.