CVE-2026-32320

Ella Core (5G private-net core) is affected by a DoS when processing a PathSwitchRequest that contains UE Security Capabilities with zero-length NR encryption or integrity protection bitstrings. The issue can crash the process via crafted NGAP messages, leading to service disruption for all conne...

Ella Core: AMF DoS via malformed PathSwitchRequest with empty NR security capability bitstrings

Summary Ella Core panics when processing a PathSwitchRequest containing UE Security Capabilities with zero-length NR encryption or integrity protection algorithm bitstrings, resulting in a denial of service. Impact An attacker able to send crafted NGAP messages to Ella Core can crash the process,...

GHSA-J478-P7VQ-3347 Ella Core: AMF DoS via malformed PathSwitchRequest with empty NR security capability bitstrings

Summary Ella Core panics when processing a PathSwitchRequest containing UE Security Capabilities with zero-length NR encryption or integrity protection algorithm bitstrings, resulting in a denial of service. Impact An attacker able to send crafted NGAP messages to Ella Core can crash the process,...

EUVD-2026-11724

Ella Core: AMF DoS via malformed PathSwitchRequest with empty NR security capability bitstrings...

PT-2025-23617 · Open5Gs · Open5Gs

Name of the Vulnerable Software and Affected Versions: Open5GS versions up to 2.7.3 Description: A vulnerability was found in the function ngap handle path switch request transfer of the file src/smf/ngap-handler.c of the component NGAP PathSwitchRequest Message Handler. The manipulation leads to...

CVE-2023-37015: Reachable Assertion

Open5GS MME versions = 2.6.4 contains an assertion that can be remotely triggered via a malformed ASN.1 packet over the S1AP interface. An attacker may send a Path Switch Request message missing a required MMEUES1APID field to repeatedly crash the MME, resulting in denial of service...