Vulnerability · Published Apr 2, 2026 · Assigned by GitHub_M
CVE-2026-34761Ella Core Panics Upon NGAP handover failure
Medium 5.8
In plain English
A medium-severity null pointer dereference in core from ellanetworks. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 26% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Ella Core is a 5G core designed for private networks. Prior to version 1.8.0, Ella Core panics when processing a NGAP handover failure message. An attacker able to cause a gNodeB to send NGAP handover failure messages to Ella Core can crash the process, causing service disruption for all connected subscribers. This issue has been patched in version 1.8.0.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | github.com/ellanetworks/core | 1.8.0 | GHSA-6gm8-3g4h-w82m |
| Go | github.com/ellanetworks/core | 1.8.0 | GO-2026-5177 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| ellanetworks | core | < 1.8.0 |
Weakness: CWE-476 · Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:N/I:N/A:H
References
- https://github.com/ellanetworks/core/security/advisories/GHSA-6gm8-3g4h-w82m x_refsource_CONFIRM
- https://github.com/ellanetworks/core/releases/tag/v1.8.0 x_refsource_MISC