Out-of-bounds Read in Ellanetworks Core
CVE-2026-32320
Ella Core is a 5G core designed for private networks. Prior to 1.5.1, Ella Core panics when processing a PathSwitchRequest containing UE Security Capabilities with zero-length NR encryption or integrity protection algorithm bitstrings, resulting in a denial of service. An attacker able to send crafted NGAP messages to Ella Core can crash the process, causing service disruption for all connected subscribers. No authentication is required. This vulnerability is fixed in 1.5.1.
Vulnerability class: Buffer Overflow
EPSS: 0.002 (8.1th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H.
Affected products
- Ellanetworks Core — versions < 1.5.1
- Ellanetworks Ella_core
Weakness classification (CWE)
References
- security-advisories@github.com (x_refsource_CONFIRM, Vendor Advisory)
Frequently asked questions
- What is CVE-2026-32320?
- CVE-2026-32320 is a medium-severity vulnerability in Ellanetworks Core, classified under Out-of-bounds Read. CVSS score: 6.5/10. Published 2026-03-13.
- How severe is CVE-2026-32320?
- Medium severity. CVSS v3 base score is 6.5 out of 10.