Vulnerability Description
Ella Core is a 5G core designed for private networks. Prior to version 1.7.0, a deadlock in the AMF's SCTP notification handler causes the entire AMF control plane to hang until the process is restarted. An attacker with access to the N2 interface can cause Ella Core to hang, resulting in a denial of service for all subscribers. Version 1.7.0 adds deferred Radio cleanup in serveConn SCTP server so that every connection exit path removes the radio. Remove the stale-entry scan from SCTP Notification handling.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Ellanetworks | Ella Core | < 1.7.0 |
Related Weaknesses (CWE)
References
- https://github.com/ellanetworks/core/commit/999f606c5cae261471d9e3f063d7ecd1bd75Patch
- https://github.com/ellanetworks/core/releases/tag/v1.7.0Release Notes
- https://github.com/ellanetworks/core/security/advisories/GHSA-9h59-p45g-445hVendor Advisory
FAQ
What is CVE-2026-33904?
CVE-2026-33904 is a vulnerability with a CVSS score of 6.5 (MEDIUM). Ella Core is a 5G core designed for private networks. Prior to version 1.7.0, a deadlock in the AMF's SCTP notification handler causes the entire AMF control plane to hang until the process is restart...
How severe is CVE-2026-33904?
CVE-2026-33904 has been rated MEDIUM with a CVSS base score of 6.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-33904?
Check the references section above for vendor advisories and patch information. Affected products include: Ellanetworks Ella Core.