CVE-2026-33904
Ellanetworks Ella Core ≤ 1.7.0
Raw vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HSummary
CVE-2026-33904 is a medium-severity Deadlock (CWE-833) vulnerability in Ellanetworks Ella Core. Its CVSS base score is 6.5 (Medium).
Operationally, ranked at the 6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SA-11 (Developer Testing and Evaluation) and SA-8 (Security and Privacy Engineering Principles) — see the control section below for these in your framework.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-16841
Vulnerability Data
Ella Core is a 5G core designed for private networks. Prior to version 1.7.0, a deadlock in the AMF's SCTP notification handler causes the entire AMF control plane to hang until the process is restarted. An attacker with access to…
more
the N2 interface can cause Ella Core to hang, resulting in a denial of service for all subscribers. Version 1.7.0 adds deferred Radio cleanup in serveConn SCTP server so that every connection exit path removes the radio. Remove the stale-entry scan from SCTP Notification handling.
- CWE(s)
Related Threats
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V15.4.3
Mitigating Controls (NIST 800-53 r5) AI
Developer testing and evaluation activities can exercise concurrent paths and resource contention to discover deadlock conditions before deployment.
Security engineering principles applied during design can incorporate synchronization ordering, timeouts, and resource hierarchies that structurally avoid deadlock formation.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices can include concurrency analysis and lock discipline to avoid deadlock conditions.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing in development can detect deadlock conditions through stress and concurrency testing.
Secure development lifecycle requires deadlock analysis and avoidance techniques during design and coding.
Secure system architecture principles include concurrency controls and resource-locking discipline that prevent deadlock.
Secure coding standards mandate safe lock ordering, timeouts, and deadlock detection patterns.
Change management may catch deadlock-related defects during reviews but does not directly address concurrency design.