7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-32319

CVE-2026-32319: Ella Core: Unauthenticated AMF DoS via malformed InitialUEMessage with undersized integrity-protected NAS payload

Ella Core is a 5G core designed for private networks. Prior to 1.5.1, Ella Core panics when processing a malformed integrity protected NGAP/NAS message with a length under 7 bytes. An attacker able to send crafted NAS messages to Ella Core can crash the process, causing service disruption for all connected subscribers. No authentication is required. This vulnerability is fixed in 1.5.1.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-32319

CVE-2026-32319:

7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/ellanetworks/core	go	< 1.5.1	1.5.1

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is an unauthenticated denial of service in Ella Core's NAS message handling. The root cause is an out-of-bounds read in the nas.fetchUeContextWithMobileIdentity function, located in internal/amf/nas/handler.go. The function did not validate the length of an integrity-protected NAS message before slicing it, assuming it would be at least 7 bytes long. An attacker could send a crafted message with a shorter payload, causing a panic when the code attempts to access payload[7:]. This crashes the service. The nas.HandleNAS function is the entry point that receives this malicious payload and passes it to the vulnerable function. The patch, found in commit 722e79f69b1edc689693416c475da9c2b56c25bd, adds the necessary length check to prevent the panic.

Vulnerable functions

nas.fetchUeContextWithMobileIdentity

internal/amf/nas/handler.go

This function is vulnerable to a panic due to an out-of-bounds read. It processes integrity-protected NAS messages and, prior to the patch, would attempt to slice the payload at the 7th byte (`payload[7:]`) without first verifying that the payload has a sufficient length. An attacker could provide a payload shorter than 7 bytes, causing a panic and a denial of service.

nas.HandleNAS

internal/amf/nas/handler.go

This function is the primary entry point for handling NAS messages from a UE. It receives the raw payload and, in the case of an initial message where no UE context exists, it calls the vulnerable function `fetchUeContextWithMobileIdentity`. Therefore, during an exploit, this function would be at the top of the stack trace, processing the malicious payload that triggers the panic.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.