Ella Core: Unauthenticated AMF DoS via malformed InitialUEMessage with undersized integrity-protected NAS payload

Vulnerability

Overview

CVE-2026-32319 is a denial-of-service vulnerability in Ella Core, a 5G core designed for private networks. Prior to version 1.5.1, the software panics when processing a malformed integrity-protected NGAP/NAS message with a length under 7 bytes [1][4]. The root cause is a missing length check in the message parsing logic, leading to a panic when the code attempts to access data beyond the buffer boundaries.

Exploitation

An attacker can exploit this vulnerability by sending a crafted NAS message to Ella Core over the network. No authentication is required, and the attack can be launched remotely [1][4]. The only prerequisite is the ability to send NAS messages to the target core, which is typically possible from any device that can connect to the 5G network or from an external network if the core is exposed.

Impact

Successful exploitation causes the Ella Core process to crash, resulting in a complete denial of service for all connected subscribers [1][4]. This disrupts all 5G services provided by the core, including voice, data, and signaling, until the process is manually restarted or automatically recovered.

Mitigation

The vulnerability is fixed in Ella Core version 1.5.1 [1][3]. Users are strongly advised to upgrade to this version or later. No workarounds are documented; upgrading is the only known mitigation.