What is GHSA-m9pm-w3gv-c68f?

GHSA-m9pm-w3gv-c68f is a security advisory published by GitHub Security Advisories with High severity. Ella Core vulnerable to Unauthenticated AMF DoS via malformed InitialUEMessage with undersized integrity-protected NAS payload

Which CVE IDs does GHSA-m9pm-w3gv-c68f cover?

GHSA-m9pm-w3gv-c68f covers the following CVE IDs: CVE-2026-32319. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-m9pm-w3gv-c68f?

GHSA-m9pm-w3gv-c68f has a CVSS v3 base score of 7.5, published by GitHub Security Advisories.

Which products are affected by GHSA-m9pm-w3gv-c68f?

GHSA-m9pm-w3gv-c68f affects 1 product, including: go/github.com/ellanetworks/core:\u003c 1.5.1.

GHSA-m9pm-w3gv-c68fHighCVSS 7.5

Ella Core vulnerable to Unauthenticated AMF DoS via malformed InitialUEMessage with undersized integrity-protected NAS payload

Vendor

GitHub Security Advisories

Published

March 12, 2026

Last Modified

March 16, 2026

🔗 CVE IDs covered (1)

CVE-2026-32319 →

📋 Description

Summary

Ella Core panics when processing a malformed integrity protected NGAP/NAS message with a length under 7 bytes.

Impact

An attacker able to send crafted NAS messages to Ella Core can crash the process, causing service disruption for all connected subscribers. No authentication is required.

Fix

Added length verification to NAS message handling.

🎯 Affected products1

go/github.com/ellanetworks/core:< 1.5.1

🔗 References (5)

https://github.com/ellanetworks/core/security/advisories/GHSA-m9pm-w3gv-c68f
https://github.com/ellanetworks/core/releases/tag/v1.5.1
https://nvd.nist.gov/vuln/detail/CVE-2026-32319
https://pkg.go.dev/vuln/GO-2026-4692
https://github.com/advisories/GHSA-m9pm-w3gv-c68f