CVE-2026-34761: Ella Core Panics Upon NGAP handover failure

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-04-02 · updated 2026-07-24
Weakness: CWE-476

Description

Ella Core is a 5G core designed for private networks. Prior to version 1.8.0, Ella Core panics when processing a NGAP handover failure message. An attacker able to cause a gNodeB to send NGAP handover failure messages to Ella Core can crash the process, causing service disruption for all connected subscribers. This issue has been patched in version 1.8.0.

Affected products

ellanetworks core: before 1.8.0 — fixed in 1.8.0

How to fix

Upgrade to a fixed version: ellanetworks core 1.8.0. Check the vendor advisory for mitigations.

References

https://github.com/ellanetworks/core/releases/tag/v1.8.0
https://github.com/ellanetworks/core/security/advisories/GHSA-6gm8-3g4h-w82m

Get alerted when CVE-2026-34761 or the next vulnerability affects your stack