CVE-2026-33907: 
vulnerability analysis and mitigation

CVE-2026-33907 is a NULL Pointer Dereference vulnerability in Ella Core, a 5G core network software designed for private networks. When processing Authentication Response or Authentication Failure NAS (Non-Access Stratum) messages that are missing required Information Elements (IEs), the process panics and crashes. All versions prior to 1.7.0 are affected. The vulnerability was published on March 24, 2026, and carries a CVSS v3.1 base score of 6.5 (Medium) (Github Advisory, Ella Security Advisory).

The root cause is a NULL Pointer Dereference (CWE-476) in Ella Core's AMF (Access and Mobility Management Function) NAS message handling code. Specifically, the handleAuthenticationResponse and handleAuthenticationFailure functions in internal/amf/nas/gmm/ directly dereference the AuthenticationResponseParameter and AuthenticationFailureParameter IEs without first verifying their presence, causing a Go runtime panic when these fields are nil. An attacker on the adjacent network can craft and send malformed NAS messages — Authentication Response or Authentication Failure messages with missing IEs — without any prior authentication, triggering the crash. The fix (commit 5296266) added explicit nil checks before dereferencing these IEs in both handler functions (Github Advisory, Patch Commit).

Successful exploitation causes the Ella Core process to crash (panic), resulting in a complete denial of service for all subscribers connected to the affected private 5G network. There is no confidentiality or integrity impact — the vulnerability is purely an availability issue. Because the crash affects the entire core process, all active sessions and connected UEs (User Equipment) would be disrupted simultaneously until the service is restarted (Github Advisory, Ella Security Advisory).

No authentication is required to exploit this vulnerability, and attack complexity is low — an attacker only needs to be on the adjacent network (e.g., the radio access network segment) and able to send crafted NAS messages to the Ella Core AMF. No public exploit code or active in-the-wild exploitation has been reported. The EPSS score is approximately 0.027% (0.000270), indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Github Advisory).

1. Reconnaissance: Identify a target private 5G network running Ella Core prior to version 1.7.0. Gain access to the adjacent network segment (e.g., the RAN or N1 interface) from which NAS messages can be sent to the AMF.
2. Craft malformed NAS message: Construct an Authentication Response NAS message with the AuthenticationResponseParameter IE omitted (set to nil/absent), or an Authentication Failure NAS message with cause SynchFailure but with the AuthenticationFailureParameter IE omitted.
3. Send crafted message: Transmit the malformed NAS message to the Ella Core AMF. No prior registration or authentication with the network is required.
4. Trigger crash: The AMF's handleAuthenticationResponse or handleAuthenticationFailure function dereferences the nil IE pointer without a nil check, causing a Go runtime panic and crashing the Ella Core process.
5. Service disruption achieved: All connected subscribers lose service until the Ella Core process is manually restarted (Github Advisory, Patch Commit).

• Logs: Go runtime panic stack traces in Ella Core logs referencing internal/amf/nas/gmm/handle_authentication_response.go or internal/amf/nas/gmm/handle_authentication_failure.go; log entries showing unexpected process termination or restart of the ella-core service.
• Process: Sudden termination and restart of the Ella Core process; monitoring alerts for AMF process crashes or service unavailability.
• Network: Unusual or malformed NAS Authentication Response or Authentication Failure messages received on the N1 interface with missing IEs, particularly from unknown or unexpected UE identities.

The vendor has released a fix in Ella Core version 1.7.0, which adds IE presence verification before dereferencing AuthenticationResponseParameter and AuthenticationFailureParameter in NAS message handlers. Operators should upgrade to v1.7.0 or later immediately. No configuration-based workaround is available; upgrading is the only remediation (Ella Release v1.7.0, Patch Commit).

The vulnerability was reported by a contributor identified as "offset" and published by the Ella Core maintainer (gruyaume) on March 24, 2026. It received routine coverage from vulnerability aggregators and security feeds shortly after disclosure, with no notable controversy or significant community discussion beyond standard advisory dissemination (Github Advisory).