{"id":"CVE-2026-44473","revision":"80efac26d01b498483d2c3e457ba54ba","records":[{"revision":"80efac26d01b498483d2c3e457ba54ba","observedAt":"2026-10-25T10:17:27.754+00:00","statement":{"source":"nvd","id":"CVE-2026-44473","aliases":[],"title":"Ella Core is a 5G core designed for private networks. Prior to 1.10.0, a radio with a valid NG Setup can send a forged PDUSessionResourceSetupResponse carrying any UE's AMF-UE-NGAP-ID. Ella Core does not verify the message arrived on the SC…","description":"Ella Core is a 5G core designed for private networks. Prior to 1.10.0, a radio with a valid NG Setup can send a forged PDUSessionResourceSetupResponse carrying any UE's AMF-UE-NGAP-ID. Ella Core does not verify the message arrived on the SCTP association bound to that UE's logical NG-connection, then creates a GTP tunnel towards that radio. This vulnerability is fixed in 1.10.0.","state":0,"publishedAt":"2026-05-27T17:16:39.07+00:00","modifiedAt":"2026-06-17T10:50:41.697+00:00","affected":[],"metrics":[{"system":"CVSS 3.1 · security-advisories@github.com · Secondary","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","score":7.1,"severity":"HIGH"}],"references":["https://github.com/ellanetworks/core/security/advisories/GHSA-qfxw-v8qx-vj3v"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-44473","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Deferred","weaknesses":["CWE-358","CWE-863"],"productCriteria":[],"sourceDates":{"published":"2026-05-27T17:16:39.070","lastModified":"2026-06-17T10:50:41.697"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2026-44473","identifiers":["CVE-2026-44473"]},"retained":false,"historicalAffected":[]}],"coverage":[]}