6.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-32320

CVE-2026-32320: Ella Core: AMF DoS via malformed PathSwitchRequest with empty NR security capability bitstrings

Ella Core is a 5G core designed for private networks. Prior to 1.5.1, Ella Core panics when processing a PathSwitchRequest containing UE Security Capabilities with zero-length NR encryption or integrity protection algorithm bitstrings, resulting in a denial of service. An attacker able to send crafted NGAP messages to Ella Core can crash the process, causing service disruption for all connected subscribers. No authentication is required. This vulnerability is fixed in 1.5.1.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-32320

CVE-2026-32320:

6.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/ellanetworks/core	go	< 1.5.1	1.5.1

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a denial-of-service in Ella Core's AMF component, as described in GHSA-j478-p7vq-3347. The root cause is an out-of-bounds read when processing a crafted NGAP PathSwitchRequest message. Analysis of the associated pull request (#1099) and its commit b26ecf3c10975d51a40ec8295cea05b2e0f376f4 points directly to the vulnerable function. The patch was applied to internal/amf/ngap/handle_path_switch_request.go, specifically within the HandlePathSwitchRequest function. Before the fix, the code did not validate the length of the NRencryptionAlgorithms and NRintegrityProtectionAlgorithms byte slices before accessing index [0]. This oversight would cause a panic if an empty slice was provided, crashing the service. The identified vulnerable function, ngap.HandlePathSwitchRequest, is the exact location where this lack of validation occurs and would be the function appearing in a stack trace during exploitation.

Vulnerable functions

ngap.HandlePathSwitchRequest

internal/amf/ngap/handle_path_switch_request.go

The function processes NGAP PathSwitchRequest messages. It directly accesses the first byte of the `NRencryptionAlgorithms` and `NRintegrityProtectionAlgorithms` bitstrings from the UE Security Capabilities IE without first checking if these bitstrings are empty. If an attacker sends a crafted message with zero-length bitstrings, this causes an out-of-bounds read, leading to a panic and a denial of service.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.