CVE-2026-33904: 
vulnerability analysis and mitigation

CVE-2026-33904 is a deadlock vulnerability in Ella Core, a 5G core network solution designed for private networks, that causes a denial of service via SCTP connection cleanup. A deadlock in the AMF's (Access and Mobility Management Function) SCTP notification handler causes the entire AMF control plane to hang until the process is manually restarted. All versions of Ella Core prior to 1.7.0 are affected. The vulnerability was published on March 24, 2026, and carries a CVSS v3.1 base score of 6.5 (Medium) (GitHub Advisory).

The root cause is classified as CWE-833 (Deadlock), mapped to CAPEC-25 (Forced Deadlock). In vulnerable versions, the AMF's SCTP notification handler acquires amf.Mutex.Lock() while scanning for stale radio entries, but this lock can conflict with other goroutines holding or waiting on the same mutex during connection teardown, causing all threads to block indefinitely. The fix, applied in commit 999f606, removes the stale-entry scan from the SCTP notification handler and instead adds a deferred radio cleanup in the serveConn function so that every connection exit path reliably removes the associated radio without holding a contested lock (GitHub Commit, GitHub Advisory). Exploitation requires adjacent network access to the N2 interface (the interface between the RAN and the AMF), with no privileges or user interaction needed.

Successful exploitation causes the entire AMF control plane to hang, resulting in a complete denial of service for all subscribers connected to the affected private 5G network. The AMF process must be manually restarted to restore service, meaning any ongoing sessions and new connection attempts will fail for the duration of the outage. There is no impact on confidentiality or data integrity — the vulnerability is purely an availability issue (GitHub Advisory).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for this vulnerability. The EPSS score is approximately 0.013% (6th percentile), indicating a low probability of exploitation in the near term (GitHub Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation is constrained to attackers with adjacent network access to the N2 interface, limiting the attack surface to those with physical or logical proximity to the 5G RAN-to-core network segment.

1. Reconnaissance: Identify a target private 5G network running Ella Core prior to version 1.7.0 and gain access to the N2 interface (the SCTP-based interface between the gNB/RAN and the AMF).
2. Establish SCTP connection: Initiate an SCTP association to the AMF's N2 listener, simulating a radio (gNB) connection.
3. Trigger SCTP notification: Abruptly terminate or manipulate the SCTP connection in a way that generates an SCTP association change notification (e.g., SCTPAssocChange) to the AMF's notification handler.
4. Induce deadlock: The notification handler attempts to acquire amf.Mutex.Lock() to scan for stale radio entries while another goroutine holds the same mutex during connection cleanup, causing both threads to block indefinitely.
5. Achieve denial of service: The AMF control plane hangs entirely, dropping all subscriber sessions and preventing new registrations until an operator manually restarts the AMF process (GitHub Advisory, GitHub Commit).

• Network: Unexpected or repeated SCTP association establishment and teardown events on the N2 interface from an unrecognized source; SCTP COMM_LOST or SHUTDOWN notifications originating from an unknown gNB IP address.
• Logs: AMF logs showing a goroutine or mutex deadlock condition; absence of new log entries from the AMF after a connection event (indicating the process has hung); log entries such as SCTPAssocChange notification followed by no further AMF activity.
• Process: The Ella Core AMF process becomes unresponsive (no new subscriber registrations processed, no heartbeat activity); operator intervention required to restart the ella-core AMF process to restore service.

The vendor has released Ella Core version 1.7.0, which resolves this vulnerability by adding deferred radio cleanup in the serveConn SCTP server and removing the stale-entry scan from SCTP notification handling. Operators should upgrade to v1.7.0 or later immediately (GitHub Release, GitHub Advisory). As a temporary workaround prior to patching, restrict access to the N2 interface using network-level controls (e.g., firewall rules, VLAN segmentation) to allow only trusted gNB IP addresses to establish SCTP connections to the AMF.

The vulnerability was reported by a contributor identified as "offset" and published by the Ella Core maintainer (gruyaume) on March 24, 2026. The advisory was reviewed and published to the GitHub Advisory Database on March 26, 2026, and subsequently picked up by the National Vulnerability Database on March 27, 2026 (GitHub Advisory). No significant broader media coverage or notable security researcher commentary beyond the official advisory has been identified.