CVE-2026-33904
MEDIUMVulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2021 - Vulnerable and Outdated Components
ASVS 5.0
V14 - Configuration Dependency management, component inventory
|
| Impact | CVSS 6.5 with vector AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H indicates a network-adjacent, unauthenticated, low-complexity attack with high availability impact but no confidentiality or integrity breach. The attack vector is restricted to the N2 interface (eNodeB/gNodeB to AMF signaling), limiting exposure to operators' internal networks rather than the public internet. However, within a carrier's infrastructure or in environments where N2 is accessible (e.g., via compromised RAN equipment or insider threat), this is straightforward to exploit with no user interaction required. No active exploitation in the wild (no KEV status provided) and no public proof-of-concept are confirmed from available data, but the simplicity of crafting SCTP packets and the deterministic nature of deadlock make this a moderate practical risk for exposed deployments. The fix is a point release (v1.7.0), indicating timely vendor response. |
| Exploit ScenarioDerived | An attacker with access to the N2 interface (e.g., a compromised base station, rogue eNodeB in the network, or insider with RAN access) sends a sequence of crafted SCTP notification packets designed to trigger the stale-entry scan while the handler holds internal locks. The AMF's notification handler deadlocks when processing these packets, the process becomes unresponsive to all incoming 5G control-plane traffic, and all attached subscribers lose connectivity until the AMF is manually restarted. No prior authentication to the N2 interface is required-the attacker only needs network adjacency to send SCTP traffic to the AMF's listening port. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 26, 2026
Ella Core's AMF control plane deadlocks in the SCTP notification handler when processing malformed or stale radio entries, allowing unauthenticated attackers with N2 interface access to hang the entire Access and Mobility Function until manual process restart, completely denying service to all subscribers. The vulnerability (CVSS 6.5, CWE-833 deadlock) stems from improper synchronization in radio cleanup logic combined with stale-entry scanning, and patches are available in version 1.7.0 and later.
RemediationAI
Upgrade Ella Core to version 1.7.0 or later, which includes deferred radio cleanup in the serveConn SCTP server and removal of the stale-entry scan from SCTP notification handling (see https://github.com/ellanetworks/core/releases/tag/v1.7.0). Until patching is complete, restrict network access to the N2 interface to only trusted RAN equipment via firewall rules, disable SCTP access from untrusted sources, and implement monitoring on the AMF process for unexpected hangs. If immediate upgrade is not feasible, consider deploying a load balancer or redundant AMF instances with automatic failover to mitigate denial of service impact.
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in go
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Ella Core (github.com/ellanetworks/core) is a 5G Access and Mobility Function (AMF) implementation in Go that handles control-plane signaling over SCTP (Stream Control Transmission Protocol). The vulnerability resides in the serveConn SCTP server's radio connection lifecycle management. CWE-833 identifies the root cause as improper synchronization in a multi-threaded context-specifically, deferred radio resource cleanup on connection exit was missing, and the stale-entry scan logic in SCTP notification handling was not thread-safe or was holding locks across I/O operations. When an attacker crafts SCTP packets that trigger notification handler execution while stale radio entries exist, the handler can deadlock waiting for locks or I/O that never complete, freezing the entire AMF process.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Primary rating from Vendor (https://github.com/ellanetworks/core).
CVSS VectorVendor: https://github.com/ellanetworks/core
Lifecycle Timeline
2DescriptionCVE.org
Summary
A deadlock in the AMF's SCTP notification handler causes the entire AMF control plane to hang until the process is restarted.
Impact
An attacker with access to the N2 interface can cause Ella Core to hang, resulting in a denial of service for all subscribers.
Fix
Add deferred Radio cleanup in serveConn SCTP server so that every connection exit path removes the radio. Remove the stale-entry scan from SCTP Notification handling.
Executive ViewAI
CVE-2026-33904 presents notable security risk rated CVSS 6.5. Exploitation could compromise the security of affected deployments. Organizations should apply vendor updates when available and monitor for exploitation.
Apply vendor patch. If patching is delayed: restrict network access and enable monitoring.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Exploit-DB