Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
3.7
CVE-2026-44474: Ella Core may drop handovers during security commands
CVE-2026-44474 · published 5 months ago
Summary
Versions of Ella Core before 1.10.0 could try to change a device's security settings while a handover to a new base station was still in progress. This overlap can cause the device and the new base station to lose sync, making the handover fail and requiring the base station to restart the connection. Upgrade to version 1.10.0 to stop the overlapping actions.
What to do
- Update github.com ellanetworks to version 1.10.0.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| go | github.com | ellanetworks |
< 1.10.0 Fix: upgrade to 1.10.0
|
Original advisory text
Ella Core: Handover failures during concurrent Security Mode Command
Ella Core is a 5G core designed for private networks. Prior to 1.10.0, Ella Core didn't enforce security rules on concurrent running of security procedures defined in TS 33.501 §6.9.5.1 — it could send a NAS Security Mode Command while an N2 handover was still pending (and vice versa). Concurrent Security Mode Command and N2 handover produce a KgNB mismatch between the UE and target gNB, causing the handover to fail. Requires a stalled gNB + re-registration race to trigger. This vulnerability is fixed in 1.10.0.
References
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Type
CWE-358Improperly Implemented Security Check for Standard
Timeline
Published27 May 2026
Updated26 Oct 2026
First seen11 May 2026
Track software like this
Free during beta