Is CVE-2026-34761 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-34761 being exploited in the wild.

How severe is CVE-2026-34761?

Medium severity, with a CVSS score of 5.8, published 2 April 2026.

Which products and versions are affected?

Ella Networks Ella Core < 1.8.0; github.com/ellanetworks/core (Go) SEMVER:introduced=0,fixed=1.8.0.

Is there a fix for CVE-2026-34761?

Yes. github.com/ellanetworks/core (Go): upgrade to 1.8.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-34761 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-34761?

Check whether you run Ella Networks Ella Core or github.com/ellanetworks/core (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-34761: Ella Networks Ella Core NULL pointer dereference in NGAP handover

Q: Is there a fix for CVE-2026-34761?

Yes. github.com/ellanetworks/core (Go): upgrade to 1.8.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-34761 attacked?

It is attacked over the network, in a hosted service.

Q: Am I affected by CVE-2026-34761?

Check whether you run Ella Networks Ella Core or github.com/ellanetworks/core (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-34761 · Severity: medium · CVSS 5.8 · Published 2026-04-02

Ella Core is a 5G core platform used to manage private cellular networks. A vulnerability in how the system handles specific handover failure messages allows an attacker to crash the core service. This results in a total loss of connectivity for all mobile subscribers on the affected private network until the service is restored.

Technologies: Ella Networks Ella Core, github.com/ellanetworks/core (Go). Vendors: Ella Networks, Go.

Quick answers

Is CVE-2026-34761 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-34761 being exploited in the wild.
How severe is CVE-2026-34761?: Medium severity, with a CVSS score of 5.8, published 2 April 2026.
Which products and versions are affected?: Ella Networks Ella Core < 1.8.0; github.com/ellanetworks/core (Go) SEMVER:introduced=0,fixed=1.8.0.
Is there a fix for CVE-2026-34761?: Yes. github.com/ellanetworks/core (Go): upgrade to 1.8.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-34761 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-34761?: Check whether you run Ella Networks Ella Core or github.com/ellanetworks/core (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/ellanetworks/core (Go): upgrade to 1.8.0 or later
```
go get github.com/ellanetworks/core@v1.8.0
```

Technical details

A NULL pointer dereference (CWE-476) exists in the NGAP handover handlers of Ella Core. The vulnerability is triggered when the core processes a malformed or specific NGAP handover failure message sent from a gNodeB (base station). An attacker with sufficient privileges to control or influence a gNodeB can send these messages to cause a process panic (crash). This results in a complete denial of service for the 5G core and its connected User Equipment (UE). The issue is fixed in version 1.8.0 by improving guards and validation within the NGAP handover handlers.

Affected products

Ella Networks Ella Core < 1.8.0

Identifiers

CVE-2026-34761
GHSA-6gm8-3g4h-w82m
GO-2026-5177

Timeline

2026-03-30: patched: Version 1.8.0 released
2026-03-30: advisory: GitHub Security Advisory GHSA-6gm8-3g4h-w82m published
2026-04-02: disclosed: CVE-2026-34761 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.