GHSA-9h59-p45g-445h

Source

https://github.com/advisories/GHSA-9h59-p45g-445h

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-9h59-p45g-445h/GHSA-9h59-p45g-445h.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-9h59-p45g-445h

Aliases

Published

2026-03-26T22:13:33Z

Modified

2026-04-02T21:26:07Z

Severity

6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator

Summary

Ella Core has a Denial of Service via SCTP connection cleanup deadlock

Details

Summary

A deadlock in the AMF's SCTP notification handler causes the entire AMF control plane to hang until the process is restarted.

Impact

An attacker with access to the N2 interface can cause Ella Core to hang, resulting in a denial of service for all subscribers.

Fix

Add deferred Radio cleanup in serveConn SCTP server so that every connection exit path removes the radio. Remove the stale-entry scan from SCTP Notification handling.

Database specific

{
    "cwe_ids":  [
        "CWE-833"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-03-26T22:13:33Z",
    "nvd_published_at":  "2026-03-27T21:17:26Z",
    "severity":  "MODERATE"
}

References

Affected packages

Go / github.com/ellanetworks/core

Package

Name: github.com/ellanetworks/core; View open source insights on deps.dev
Purl: pkg:golang/github.com/ellanetworks/core

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

1.7.0

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-9h59-p45g-445h/GHSA-9h59-p45g-445h.json"