What is GHSA-f2f3-9cx3-wcmf?

GHSA-f2f3-9cx3-wcmf is a security advisory published by GitHub Security Advisories with Medium severity. Ella Core panics when processing a crafted NGAP LocationReport message

Which CVE IDs does GHSA-f2f3-9cx3-wcmf cover?

GHSA-f2f3-9cx3-wcmf covers the following CVE IDs: CVE-2026-33903. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-f2f3-9cx3-wcmf?

GHSA-f2f3-9cx3-wcmf has a CVSS v3 base score of 6.5, published by GitHub Security Advisories.

Which products are affected by GHSA-f2f3-9cx3-wcmf?

GHSA-f2f3-9cx3-wcmf affects 1 product, including: go/github.com/ellanetworks/core:\u003c 1.7.0.

GHSA-f2f3-9cx3-wcmfMediumCVSS 6.5

Ella Core panics when processing a crafted NGAP LocationReport message

Vendor

GitHub Security Advisories

Published

March 26, 2026

Last Modified

March 27, 2026

🔗 CVE IDs covered (1)

CVE-2026-33903 →

📋 Description

Summary

Ella Core panics when processing a specially crafted NGAP LocationReport message.

Impact

An attacker able to send crafted NGAP messages to Ella Core can crash the process, causing service disruption for all connected subscribers.

Fix

Add guards in NGAP Location Report handler.

🎯 Affected products1

go/github.com/ellanetworks/core:< 1.7.0

🔗 References (5)

https://github.com/ellanetworks/core/security/advisories/GHSA-f2f3-9cx3-wcmf
https://github.com/ellanetworks/core/commit/ec77a2ad4508f8488cb356fd45b2f1efd92587f8
https://github.com/ellanetworks/core/releases/tag/v1.7.0
https://nvd.nist.gov/vuln/detail/CVE-2026-33903
https://github.com/advisories/GHSA-f2f3-9cx3-wcmf