Ella Core is a 5G core network implementation that processes NGAP messages. The vulnerability is triggered when a PathSwitchRequest contains UE Security Capabilities with zero‑length NR encryption or integrity protection algorithm bitstrings. The AMF process panics, causing a crash that results in denial of service for all connected subscribers. The weakness corresponds to an out‑of‑bounds read (CWE‑125). No authentication is required to send the crafted NGAP message, so the attack can be performed by any entity capable of sending NGAP traffic to the network.

All deployments of Ella Core prior to version 1.5.1 are affected. The impacted product is listed in the CPE string cpe:2.3:a:ellanetworks:ella_core:*:*:*:*:*:*:*:*. Operators using ellanetworks:core without upgrading to 1.5.1 or newer are exposed to this flaw.

The CVSS base score is 6.5, indicating medium severity. The EPSS score is less than 1 %, suggesting a low probability of exploitation. The vulnerability is not listed in CISA’s KEV catalog. However, because the exploit does not require authentication and relies on a simple, malformed NGAP message, the potential impact of a successful exploit is significant, as a single attack can disrupt services for an entire private 5G network. Operators should treat this as a medium to high risk depending on the exposure of their NGAP interfaces.