Ella Core: AMF DoS via malformed PathSwitchRequest with empty NR security capability bitstrings

Vulnerability

Details Ella Core, a 5G core for private networks, contains a denial-of-service vulnerability in the Access and Mobility Management Function (AMF). When processing a PathSwitchRequest message, the software does not properly validate the length of the UE Security Capabilities information element, specifically the NR encryption algorithm bitstring and NR integrity protection algorithm bitstring. If these bitstrings are zero-length, the system panics, leading to a crash [1][4].

Exploitation

An attacker with network access to the Ella Core instance can send a crafted NGAP (Next Generation Application Protocol) PathSwitchRequest message with zero-length security capability bitstrings. No authentication is required, and no prior knowledge of the network is necessary beyond the IP address of the AMF. The lack of input validation makes this a trivial remote exploit [1].

Impact

Successful exploitation crashes the Ella Core process, causing a denial of service for all connected subscribers. Since the entire 5G core is contained in a single binary, any disruption affects all users. The attacker can repeatedly send such messages to maintain the denial of service, and recovery requires restarting the service [1][4].

Mitigation

The vulnerability is fixed in Ella Core version 1.5.1, released on 2026-03-12 [3]. Users are strongly advised to upgrade immediately. No workarounds are available. This vulnerability is not known to be exploited in the wild at the time of publication, but given its simplicity, urgent patching is recommended [1].