GHSA-pwfh-mqp3-pqwj

Source

https://github.com/advisories/GHSA-pwfh-mqp3-pqwj

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-pwfh-mqp3-pqwj/GHSA-pwfh-mqp3-pqwj.json

JSON Data

https://api.test.osv.dev/v1/vulns/GHSA-pwfh-mqp3-pqwj

Aliases

Published

2026-05-11T15:29:37Z

Modified

2026-06-25T23:11:24Z

Severity

6.1 (Medium) CVSS_V3 - CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:L CVSS Calculator

Summary

Ella Core has a UE Security Capability bypass on NGAP PathSwitchRequest

Details

Summary

Ella Core does not verify the UE Security Capabilities received in NGAP PathSwitchRequest messages against its locally stored values. A malicious gNB can overwrite Ella Core's stored UE security capabilities for any UE with arbitrary values by sending a single crafted PathSwitchRequest.

Impact

A gNB can corrupt Ella Core's stored UE security capabilities for a target UE.

Fix

The PathSwitchRequest handler now compares the received UE Security Capabilities against Ella Core's locally stored values, preserves the stored values on mismatch, returns them in the PathSwitchRequestAcknowledge, and logs the event.

Database specific

{
    "cwe_ids": [
        "CWE-358"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-05-11T15:29:37Z",
    "nvd_published_at": "2026-05-27T17:16:39Z",
    "severity": "MODERATE"
}

References

Affected packages

Go / github.com/ellanetworks/core

Package

Name: github.com/ellanetworks/core; View open source insights on deps.dev
Purl: pkg:golang/github.com/ellanetworks/core

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

1.10.0

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-pwfh-mqp3-pqwj/GHSA-pwfh-mqp3-pqwj.json"