CVE-2026-33281: Ellanetworks Ella Core DOS Vulnerability

CVE-2026-33281 Overview

CVE-2026-33281 is a Denial of Service vulnerability in Ella Core, a 5G core network solution designed for private networks. The vulnerability exists in the NGAP (Next Generation Application Protocol) message processing component, which fails to properly validate PDU Session IDs. When the software receives NGAP messages containing PDU Session IDs outside the valid range of 1-15, the process panics and crashes, resulting in complete service disruption for all connected subscribers.

Critical Impact

Unauthenticated attackers can crash the Ella Core 5G network component by sending crafted NGAP messages, causing service outages for all connected 5G subscribers in private network deployments.

Affected Products

• Ellanetworks Ella Core versions prior to 1.6.0
• Private 5G network deployments using vulnerable Ella Core instances
• All subscribers connected through affected Ella Core implementations

Discovery Timeline

• 2026-03-24 - CVE-2026-33281 published to NVD
• 2026-03-24 - Last updated in NVD database

Technical Details for CVE-2026-33281

Vulnerability Analysis

This vulnerability is classified as CWE-129 (Improper Validation of Array Index), occurring within the NGAP message handling routines of Ella Core. The 5G core network component processes NGAP messages from gNodeB (base station) connections without properly validating the PDU Session ID field. In the 5G NR (New Radio) specification, valid PDU Session IDs must be within the range of 1-15. When Ella Core receives an NGAP message containing a PDU Session ID value outside this valid range, the software encounters an unhandled condition that causes the process to panic.

The vulnerability is particularly severe because NGAP is a critical control plane protocol in 5G networks, used for communication between the Access and Mobility Management Function (AMF) and the Radio Access Network. The lack of authentication requirements means any attacker with network access to the NGAP interface can exploit this vulnerability.

Root Cause

The root cause is inadequate input validation in the NGAP message parsing logic. The code assumes that incoming PDU Session ID values will always be within the valid 1-15 range defined by 3GPP specifications, but fails to enforce this constraint before using the value. When an out-of-bounds value is processed, it triggers a panic condition in the application, likely due to an array index out of bounds error or an assertion failure.

Attack Vector

The attack requires network-level access to the Ella Core NGAP interface. An attacker can craft malicious NGAP messages with invalid PDU Session ID values (such as 0, 16, or any value outside 1-15) and send them to the target system. Upon receiving these malformed messages, the Ella Core process crashes without requiring any authentication or prior authorization. This can be executed remotely over the network, and the attack complexity is low since it only requires sending specially crafted network packets.

The vulnerability is exploited by sending NGAP PDU Session Resource Setup Request or similar messages containing PDU Session IDs outside the valid 1-15 range. When Ella Core processes these messages, the invalid session ID triggers an unhandled exception in the session management code path, causing the entire 5G core process to crash. Detailed technical information can be found in the GitHub Security Advisory.

Detection Methods for CVE-2026-33281

Indicators of Compromise

• Unexpected Ella Core process crashes or restarts in system logs
• NGAP messages containing PDU Session ID values of 0 or greater than 15
• Sudden disconnection of all subscribers from the 5G network
• Core dump files indicating panic conditions in NGAP message handlers

Detection Strategies

• Monitor NGAP traffic for messages containing invalid PDU Session ID values (outside range 1-15)
• Implement network intrusion detection rules to flag malformed NGAP messages
• Configure process monitoring to alert on unexpected Ella Core crashes or rapid restart cycles
• Review application logs for panic stack traces related to PDU session handling

Monitoring Recommendations

• Deploy network traffic analysis at NGAP interface boundaries to inspect message contents
• Enable detailed logging for NGAP message processing in Ella Core
• Configure high-availability monitoring to detect service disruptions affecting subscriber connectivity
• Set up alerting thresholds for abnormal rates of NGAP message processing errors

How to Mitigate CVE-2026-33281

Immediate Actions Required

• Upgrade Ella Core to version 1.6.0 or later immediately
• Implement network segmentation to restrict access to NGAP interfaces
• Deploy network-level filtering to block NGAP messages from untrusted sources
• Enable process supervision to automatically restart crashed Ella Core instances as a temporary measure

Patch Information

Ellanetworks has released version 1.6.0 of Ella Core which includes proper PDU Session ID validation during NGAP message handling. The patch adds boundary checks to ensure PDU Session IDs are within the valid 1-15 range before processing, preventing the panic condition. Organizations should obtain the update through the official Ellanetworks distribution channels. For detailed patch information, refer to the GitHub Security Advisory.

Workarounds

• Restrict network access to NGAP interfaces using firewall rules to allow only trusted gNodeB connections
• Deploy a network proxy or security appliance to validate NGAP message contents before forwarding to Ella Core
• Implement rate limiting on NGAP interfaces to reduce the impact of repeated exploitation attempts

# Example firewall configuration to restrict NGAP access
# Allow only trusted gNodeB IP addresses to reach NGAP port (typically SCTP port 38412)
iptables -A INPUT -p sctp --dport 38412 -s <trusted_gnb_ip_range> -j ACCEPT
iptables -A INPUT -p sctp --dport 38412 -j DROP