3.7

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-44474

CVE-2026-44474: Ella Core has handover failures during concurrent Security Mode Command

Summary

Ella Core didn't enforce security rules on concurrent running of security procedures defined in TS 33.501 §6.9.5.1 — it could send a NAS Security Mode Command while an N2 handover was still pending (and vice versa).

Impact

Concurrent Security Mode Command and N2 handover produce a KgNB mismatch between the UE and target gNB, causing the handover to fail. Requires a stalled gNB + re-registration race to trigger.

Fix

Ella Core now enforces both rules from §6.9.5.1, blocking concurrent Security Mode Command and N2 handover procedures.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-44474

CVE-2026-44474:

3.7

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/ellanetworks/core	go	< 1.10.0	1.10.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability, GHSA-mc29-hmx6-856q, describes a race condition in Ella Core where a NAS Security Mode Command and an N2 handover procedure can run concurrently, leading to handover failure. This violates the rules specified in 3GPP TS 33.501 §6.9.5.1.

The root cause was the inadequate mechanism for tracking ongoing procedures. The system used a simple string flag (OnGoing) which could only represent a single ongoing procedure and lacked the logic to prevent conflicting procedures from starting.

The fix, identified in commit 0292160762472ddbae79c5017e997eb5ac545fbb, was to replace this simple flag with a more robust procedure.Registry. This new registry maintains a list of all active procedures for a User Equipment (UE) and, crucially, implements a conflict matrix (internal/amf/procedure/matrix.go). This matrix explicitly defines which procedures are mutually exclusive. Specifically, it blocks a SecurityMode procedure from starting if an N2Handover is active, and vice-versa.

The two key functions that were vulnerable are the ones that initiate these conflicting procedures:

gmm.securityMode (in internal/amf/nas/gmm/security_mode.go): This function initiates the Security Mode procedure. Before the patch, it did not check for an ongoing N2 handover. The patch added a call to ue.Procedures.Begin(..., procedure.SecurityMode) which consults the conflict matrix, preventing the procedure from starting if a conflict exists.
ngap.HandleHandoverRequired (in internal/amf/ngap/handle_handover_required.go): This function initiates the N2 handover procedure. Before the patch, it did not check for an ongoing Security Mode procedure. The patch added a call to amfUe.Procedures.Begin(..., procedure.N2Handover), which similarly prevents the handover if a conflicting procedure like Security Mode is active.

By exploiting the lack of locking between these two functions, an attacker could trigger the race condition, causing a denial of service for the handover procedure. The other modified files in the commit are related to integrating this new procedure registry and ensuring procedures are correctly started and stopped throughout the codebase.

Vulnerable functions

gmm.securityMode

internal/amf/nas/gmm/security_mode.go

This function initiates the NAS Security Mode procedure. The vulnerability is that prior to the patch, it did not check for a concurrent N2 handover procedure, allowing a race condition that leads to handover failure. The patch introduces a check using the new procedure registry to block this concurrent execution.

ngap.HandleHandoverRequired

internal/amf/ngap/handle_handover_required.go

This function initiates the N2 handover procedure. The vulnerability is that prior to the patch, it did not check for a concurrent Security Mode procedure, allowing a race condition that leads to handover failure. The patch introduces a check using the new procedure registry to block this concurrent execution.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.