# github.com/ellanetworks/core (Go) vulnerabilities

14 known vulnerabilities (4 high, 8 medium, 2 low), with the versions each affects and the releases that fix them.

## At a glance

- Latest release: not known (cve.now hasn't read this package's releases)
- Newest unaffected release: not known without release data
- Registry: https://pkg.go.dev/github.com/ellanetworks/core

## Advisories (14)

### [CVE-2026-44473](https://cve.now/CVE-2026-44473): Ella Core: UE Downlink Redirection via Forged PDUSessionResourceSetupResponse

- Severity: High 7.1
- Published: May 27, 2026
- Affected: fixed in 1.10.0.

### [CVE-2026-44475](https://cve.now/CVE-2026-44475): Ella Core: UE Security Capability bypass on NGAP PathSwitchRequest

- Severity: Medium 6.1
- Published: May 27, 2026
- Affected: fixed in 1.10.0.

### [CVE-2026-44474](https://cve.now/CVE-2026-44474): Ella Core: Handover failures during concurrent Security Mode Command

- Severity: Low 3.7
- Published: May 27, 2026
- Affected: fixed in 1.10.0.

### [CVE-2026-34762](https://cve.now/CVE-2026-34762): Ella Core Has Audit Log Falsification via Path/Body IMSI Mismatch in UpdateSubscriber

- Severity: Low 2.7
- Published: Apr 2, 2026
- Affected: fixed in 1.8.0.

### [CVE-2026-34761](https://cve.now/CVE-2026-34761): Ella Core Panics Upon NGAP handover failure

- Severity: Medium 5.8
- Published: Apr 2, 2026
- Affected: fixed in 1.8.0.

### [CVE-2026-33907](https://cve.now/CVE-2026-33907): Ella Core Panics during NAS Authentication Response/Failure with missing IEs

- Severity: Medium 6.5
- Published: Mar 27, 2026
- Affected: fixed in 1.7.0.

### [CVE-2026-33906](https://cve.now/CVE-2026-33906): Ella Core has Privilege Escalation via Database Restore by NetworkManager role

- Severity: High 7.2
- Published: Mar 27, 2026
- Affected: fixed in 1.7.0.

### [CVE-2026-33904](https://cve.now/CVE-2026-33904): Ella Core has a Denial of Service via SCTP connection cleanup deadlock

- Severity: Medium 6.5
- Published: Mar 27, 2026
- Affected: fixed in 1.7.0.

### [CVE-2026-33903](https://cve.now/CVE-2026-33903): Ella Core panics when processing a crafted NGAP LocationReport message

- Severity: Medium 6.5
- Published: Mar 27, 2026
- Affected: fixed in 1.7.0.

### [CVE-2026-33283](https://cve.now/CVE-2026-33283): Ella Core panics on malformed ULNASTransport Message without a Request Type

- Severity: Medium 6.5
- Published: Mar 23, 2026
- Affected: fixed in 1.6.0.

### [CVE-2026-33282](https://cve.now/CVE-2026-33282): Ella Core panics on malformed NGAP Location Report

- Severity: High 7.5
- Published: Mar 23, 2026
- Affected: fixed in 1.6.0.

### [CVE-2026-33281](https://cve.now/CVE-2026-33281): Ella Core panics on invalid PDU Session IDs in NGAP messages

- Severity: Medium 6.5
- Published: Mar 23, 2026
- Affected: fixed in 1.6.0.

### [CVE-2026-32320](https://cve.now/CVE-2026-32320): Ella Core: AMF DoS via malformed PathSwitchRequest with empty NR security capability bitstrings

- Severity: Medium 6.5
- Published: Mar 12, 2026
- Affected: fixed in 1.5.1.

### [CVE-2026-32319](https://cve.now/CVE-2026-32319): Ella Core: Unauthenticated AMF DoS via malformed InitialUEMessage with undersized integrity-protected NAS payload

- Severity: High 7.5
- Published: Mar 12, 2026
- Affected: fixed in 1.5.1.

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/packages/go/github.com/ellanetworks/core
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.