# CVE-2026-34761: Ella Networks Ella Core NULL pointer dereference in NGAP handover

Source: https://junglewise.ai/threats/cve-2026-34761-ella-networks-ella-core-null-pointer-dereference-in-ngap-handover  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-02. Updated: 2026-07-24  
License: CC BY 4.0 with a link back

CVE-2026-34761 · Severity: medium · CVSS 5.8 · Published 2026-04-02

Ella Core is a 5G core platform used to manage private cellular networks. A vulnerability in how the system handles specific handover failure messages allows an attacker to crash the core service. This results in a total loss of connectivity for all mobile subscribers on the affected private network until the service is restored.

Technologies: [Ella Networks Ella Core](https://junglewise.ai/threats/technologies/ella-core), [github.com/ellanetworks/core (Go)](https://junglewise.ai/threats/technologies/github-com-ellanetworks-core). Vendors: [Ella Networks](https://junglewise.ai/threats/vendors/ella-networks), [Go](https://junglewise.ai/threats/vendors/go).

## Quick answers

**Is CVE-2026-34761 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-34761 being exploited in the wild.

**How severe is CVE-2026-34761?** Medium severity, with a CVSS score of 5.8, published 2 April 2026.

**Which products and versions are affected?** Ella Networks Ella Core < 1.8.0; github.com/ellanetworks/core (Go) SEMVER:introduced=0,fixed=1.8.0.

**Is there a fix for CVE-2026-34761?** Yes. github.com/ellanetworks/core (Go): upgrade to 1.8.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-34761 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-34761?** Check whether you run Ella Networks Ella Core or github.com/ellanetworks/core (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/ellanetworks/core (Go): upgrade to 1.8.0 or later

  ```sh
  go get github.com/ellanetworks/core@v1.8.0
  ```


## Technical details

A NULL pointer dereference (CWE-476) exists in the NGAP handover handlers of Ella Core. The vulnerability is triggered when the core processes a malformed or specific NGAP handover failure message sent from a gNodeB (base station). An attacker with sufficient privileges to control or influence a gNodeB can send these messages to cause a process panic (crash). This results in a complete denial of service for the 5G core and its connected User Equipment (UE). The issue is fixed in version 1.8.0 by improving guards and validation within the NGAP handover handlers.

## Affected products

- Ella Networks Ella Core < 1.8.0

## Identifiers

- CVE-2026-34761
- GHSA-6gm8-3g4h-w82m
- GO-2026-5177

## Timeline

- 2026-03-30: patched: Version 1.8.0 released
- 2026-03-30: advisory: GitHub Security Advisory GHSA-6gm8-3g4h-w82m published
- 2026-04-02: disclosed: CVE-2026-34761 published

## References

- [https://github.com/ellanetworks/core/releases/tag/v1.8.0](https://github.com/ellanetworks/core/releases/tag/v1.8.0)
- [https://github.com/ellanetworks/core/security/advisories/GHSA-6gm8-3g4h-w82m](https://github.com/ellanetworks/core/security/advisories/GHSA-6gm8-3g4h-w82m)

## Related threats

- [Ella Networks Ella Core security bypass in NGAP PathSwitchRequest](https://junglewise.ai/threats/cve-2026-44475-ella-networks-ella-core-security-bypass-in-ngap-pathswitchrequest)
- [Ella Networks Ella Core improper security check in 5G NAS procedures](https://junglewise.ai/threats/cve-2026-44474-ella-networks-ella-core-improper-security-check-in-5g-nas)
- [Ella Networks Ella Core traffic redirection in NGAP handling](https://junglewise.ai/threats/cve-2026-44473-ella-networks-ella-core-traffic-redirection-in-ngap-handling)
- [Ella Networks Ella Core audit log falsification in subscriber API](https://junglewise.ai/threats/cve-2026-34762-ella-networks-ella-core-audit-log-falsification-in-subscriber-api)
- [GO-2026-4872 - Ella Core Panics during NAS Authentication Response/Failure with missing IEs in github.com/ellanetworks/core](https://junglewise.ai/threats/cve-2026-33907-ella-core-panics-during-nas-authentication-response-failure-with)