VYPR
← All advisories
Medium severity6.5NVD Advisory· Published Mar 27, 2026· Updated Apr 20, 2026

CVE-2026-33907

CVE-2026-33907

Description

Ella Core is a 5G core designed for private networks. Versions prior to 1.7.0 panic when processing Authentication Response and Authentication Failure NAS message missing IEs. An attacker able to send crafted NAS messages to Ella Core can crash the process, causing service disruption for all connected subscribers. No authentication is required. Version 1.7.0 added IE presence verification to NAS message handling.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
github.com/ellanetworks/coreGo
< 1.7.01.7.0

Affected products

1

Patches

1
52962660e3bd

fix: panic in authentication NAS message missing IEs (#1139)

https://github.com/ellanetworks/coreGuillaume BelangerMar 20, 2026via ghsa
commit
4 files changed · +46 −0
  • internal/amf/nas/gmm/handle_authentication_failure.go+4 −0 modified
    @@ -75,6 +75,10 @@ func handleAuthenticationFailure(ctx context.Context, amf *amfContext.AMF, ue *a
 			return nil
 		}
 
+		if msg.AuthenticationFailureParameter == nil {
+			return fmt.Errorf("missing AuthenticationFailureParameter IE for SynchFailure")
+		}
+
 		auts := msg.GetAuthenticationFailureParameter()
 		resynchronizationInfo := &models.ResynchronizationInfo{
 			Auts: hex.EncodeToString(auts[:]),
  • internal/amf/nas/gmm/handle_authentication_failure_test.go+22 −0 modified
    @@ -397,3 +397,25 @@ func TestHandleAuthenticationFailure_SynchFailure_SecondTime_DeregistersAndSends
 		t.Fatalf("expected AuthenticationReject message, got: %v", nm.GmmHeader.GetMessageType())
 	}
 }
+
+func TestHandleAuthenticationFailure_SynchFailure_NilAuthenticationFailureParameter(t *testing.T) {
+	amfSelf := amfContext.AMFSelf()
+	amfSelf.Smf = &FakeSmf{}
+
+	ue, _, err := buildUeAndRadio()
+	if err != nil {
+		t.Fatalf("could not build UE and radio: %v", err)
+	}
+
+	ue.State = amfContext.Authentication
+	ue.AuthFailureCauseSynchFailureTimes = 0
+
+	// Build message with SynchFailure cause but nil AuthenticationFailureParameter
+	msg := buildTestAuthenticationFailureMessage(nasMessage.Cause5GMMSynchFailure, nil)
+
+	// This must not panic — before the fix it caused a nil pointer dereference
+	err = handleAuthenticationFailure(t.Context(), &amfContext.AMF{}, ue, msg)
+	if err == nil {
+		t.Fatal("expected error when AuthenticationFailureParameter is nil, got nil")
+	}
+}
  • internal/amf/nas/gmm/handle_authentication_response.go+4 −0 modified
    @@ -29,6 +29,10 @@ func handleAuthenticationResponse(ctx context.Context, amf *amfContext.AMF, ue *
 		return fmt.Errorf("ue Authentication Context is nil")
 	}
 
+	if msg.AuthenticationResponseParameter == nil {
+		return fmt.Errorf("missing AuthenticationResponseParameter IE")
+	}
+
 	resStar := msg.GetRES()
 
 	// Calculate HRES* (TS 33.501 Annex A.5)
  • internal/amf/nas/gmm/handle_authentication_response_test.go+16 −0 modified
    @@ -17,6 +17,22 @@ import (
 	"github.com/free5gc/nas/security"
 )
 
+func TestHandleAuthenticationResponse_NilAuthenticationResponseParameter(t *testing.T) {
+	ue := &amfContext.AmfUe{
+		State:             amfContext.Authentication,
+		AuthenticationCtx: &models.Av5gAka{Rand: "DEADBEEF"},
+	}
+
+	msg := &nasMessage.AuthenticationResponse{
+		AuthenticationResponseParameter: nil,
+	}
+
+	err := handleAuthenticationResponse(context.TODO(), &amfContext.AMF{}, ue, msg)
+	if err == nil {
+		t.Fatal("expected error when AuthenticationResponseParameter is nil, got nil")
+	}
+}
+
 func TestHandleAuthenticationResponse_PreconditionErrors(t *testing.T) {
 	type TestCase struct {
 		name string

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

5

News mentions

0

No linked articles in our index yet.