CVE-2026-32319: Ella Core vulnerable to Unauthenticated AMF DoS via malformed InitialUEMessage with undersized integrity-protected NAS payload

March 12, 2026 (updated March 16, 2026)

Ella Core panics when processing a malformed integrity protected NGAP/NAS message with a length under 7 bytes.

References

github.com/advisories/GHSA-m9pm-w3gv-c68f
github.com/ellanetworks/core
github.com/ellanetworks/core/releases/tag/v1.5.1
github.com/ellanetworks/core/security/advisories/GHSA-m9pm-w3gv-c68f
nvd.nist.gov/vuln/detail/CVE-2026-32319
pkg.go.dev/vuln/GO-2026-4692

Code Behaviors & Features

Detect and mitigate CVE-2026-32319 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →