EUVD-2026-32561
GHSA-mc29-hmx6-856q
Severity by source
AV:A/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L
Lifecycle Timeline
3DescriptionGitHub Advisory
Summary
Ella Core didn't enforce security rules on concurrent running of security procedures defined in TS 33.501 §6.9.5.1 - it could send a NAS Security Mode Command while an N2 handover was still pending (and vice versa).
Impact
Concurrent Security Mode Command and N2 handover produce a KgNB mismatch between the UE and target gNB, causing the handover to fail. Requires a stalled gNB + re-registration race to trigger.
Fix
Ella Core now enforces both rules from §6.9.5.1, blocking concurrent Security Mode Command and N2 handover procedures.
AnalysisAI
Ella Core fails to enforce 3GPP TS 33.501 §6.9.5.1 security rules, allowing concurrent NAS Security Mode Command and N2 handover procedures that produce KgNB key mismatches between UE and target gNB, causing handover failures. Exploitation requires a stalled gNB combined with a re-registration race condition. Vendor-released patch: version 1.10.0.
Technical ContextAI
Ella Core is a 5G network core implementation handling NAS (Non-Access Stratum) security procedures and N2 handover between gNodeBs (gNBs). The vulnerability stems from inadequate enforcement of 3GPP TS 33.501 §6.9.5.1, which mandates serialization of critical security procedures. Specifically, a NAS Security Mode Command and N2 handover cannot execute concurrently without desynchronizing the KgNB (next hop chaining key for gNB) between the User Equipment (UE) and target gNB. This is classified as CWE-358 (Improperly Restricted Operations within the Bounds of a Resource Limit), reflecting the failure to serialize or block concurrent execution of mutually exclusive security operations.
RemediationAI
Upgrade Ella Core to version 1.10.0 or later, which enforces both concurrency serialization rules from TS 33.501 §6.9.5.1. The patch blocks concurrent execution of NAS Security Mode Command and N2 handover procedures. No workarounds are available for older versions; patching is the only remediation. Organizations running Ella Core 1.9.x and earlier should prioritize this upgrade to prevent handover failures during concurrent security procedures, though the risk is mitigated by the requirement for privileged network-adjacent access and gNB stall conditions. See https://github.com/ellanetworks/core/security/advisories/GHSA-mc29-hmx6-856q for detailed upgrade instructions.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today