CVE-2026-33904

Ella Core is a 5G core designed for private networks. Prior to version 1.7.0, a deadlock in the AMF's SCTP notification handler causes the entire AMF control plane to hang until the process is restarted. An attacker with access to the N2 interface can cause Ella Core to hang, resulting in a denial of service for all subscribers. Version 1.7.0 adds deferred Radio cleanup in serveConn SCTP server so that every connection exit path removes the radio. Remove the stale-entry scan from SCTP Notification handling.

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector ADJACENT_NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/ellanetworks/core/commit/999f606c5cae261471d9e3f063d7ecd1bd754076	Patch
https://github.com/ellanetworks/core/releases/tag/v1.7.0	Release Notes
https://github.com/ellanetworks/core/security/advisories/GHSA-9h59-p45g-445h	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:ellanetworks:ella_core:*:*:*:*:*:*:*:*

History

26 Oct 2026, 22:10

Type	Values Removed	Values Added
Summary		(es) Ella Core es un núcleo 5G diseñado para redes privadas. Antes de la versión 1.7.0, un interbloqueo en el gestor de notificaciones SCTP del AMF provoca que todo el plano de control del AMF se cuelgue hasta que se reinicie el proceso. Un atacante con acceso a la interfaz N2 puede provocar que Ella Core se cuelgue, lo que resulta en una denegación de servicio para todos los suscriptores. La versión 1.7.0 añade una limpieza de radio diferida en el servidor SCTP serveConn para que cada ruta de salida de conexión elimine la radio. Eliminar el escaneo de entradas obsoletas del manejo de notificaciones SCTP.

Information

Published : 2026-03-27 21:17

Updated : 2026-10-26 22:10

NVD link : CVE-2026-33904

Mitre link : CVE-2026-33904

CVE.ORG link : CVE-2026-33904

JSON object : View

Products Affected

ellanetworks

ella_core

CWE

CWE-833

Deadlock

{"id": "CVE-2026-33904", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-33904", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-31T14:06:26.825446Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "ellanetworks", "product": "core", "versions": [{"status": "affected", "version": "< 1.7.0"}]}]}], "published": "2026-03-27T21:17:26.640", "references": [{"url": "https://github.com/ellanetworks/core/commit/999f606c5cae261471d9e3f063d7ecd1bd754076", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/ellanetworks/core/releases/tag/v1.7.0", "tags": ["Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/ellanetworks/core/security/advisories/GHSA-9h59-p45g-445h", "tags": ["Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-833"}]}], "descriptions": [{"lang": "en", "value": "Ella Core is a 5G core designed for private networks. Prior to version 1.7.0, a deadlock in the AMF's SCTP notification handler causes the entire AMF control plane to hang until the process is restarted. An attacker with access to the N2 interface can cause Ella Core to hang, resulting in a denial of service for all subscribers. Version 1.7.0 adds deferred Radio cleanup in serveConn SCTP server so that every connection exit path removes the radio. Remove the stale-entry scan from SCTP Notification handling."}, {"lang": "es", "value": "Ella Core es un n\u00facleo 5G dise\u00f1ado para redes privadas. Antes de la versi\u00f3n 1.7.0, un interbloqueo en el gestor de notificaciones SCTP del AMF provoca que todo el plano de control del AMF se cuelgue hasta que se reinicie el proceso. Un atacante con acceso a la interfaz N2 puede provocar que Ella Core se cuelgue, lo que resulta en una denegaci\u00f3n de servicio para todos los suscriptores. La versi\u00f3n 1.7.0 a\u00f1ade una limpieza de radio diferida en el servidor SCTP serveConn para que cada ruta de salida de conexi\u00f3n elimine la radio. Eliminar el escaneo de entradas obsoletas del manejo de notificaciones SCTP."}], "lastModified": "2026-10-26T22:10:00.163", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:ellanetworks:ella_core:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9BAD1DBD-ED4B-49AB-A563-C4838F8F8979", "versionEndExcluding": "1.7.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}