CVE-2026-37221
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk27th percentile - higher than 27% of all known CVEs
Summary
FlexRIC v2.0.0 crashes when receiving a RIC_SUBSCRIPTION_RESPONSE with an unknown ric_id that has no pending event. The near-RT RIC uses assert() to enforce a pending event. A remote unauthenticated attacker can send a forged response to port 36421, causing SIGABRT (Debug) or NULL pointer dereference (SIGSEGV) in Release builds.
Risk Assessment
A DoS attack can crash the near-RT RIC, disrupting RAN operations and potentially affecting cellular services.
Recommendation
Upgrade FlexRIC to a patched version if available, or apply traffic filtering on port 36421.
Other vulnerabilities in FlexRIC
See all- CVE-2026-37234High
FlexRIC v2.0.0 allows binding multiple xapp_ids to a single SCTP connection by sending multiple E42_SETUP_REQUESTs. On disconnect, only the first registered xapp_id's resources are cleaned up, leaving stale entries. A remote attacker can exploit this to leak subscription state in the iApp, potentially causing resource exhaustion or state corruption.
- CVE-2026-37235High
FlexRIC v2.0.0 trusts the xapp_id field from E42 messages without binding it to the sender's SCTP association. A remote unauthenticated attacker can impersonate any xApp by sending requests to iApp (port 36422), causing misrouted responses and potentially crashing the victim xApp, RIC, or iApp due to state inconsistencies in the red-black tree.
- CVE-2026-37233High
In FlexRIC v2.0.0, an authorization bypass vulnerability exists in the iApp's xApp isolation mechanism. The function eq_xapp_ric_gen_id() in src/ric/iApp/xapp_ric_id.c compares m0->xapp_id against itself (m0->xapp_id) instead of the other argument (m1->xapp_id), effectively ignoring the xApp identity dimension. A malicious xApp connected to the iApp (port 36422) can delete any other xApp's subscriptions by sending an E42_RIC_SUBSCRIPTION_DELETE_REQUEST with a matching ric_gen_id.
- CVE-2026-37231High
FlexRIC v2.0.0 uses a uint16_t counter for xapp_id assignment but stores the value in uint32_t message fields. After 65,530+ E42_SETUP_REQUESTs, the 16-bit counter wraps around and produces duplicate xapp_ids. The iApp (port 36422) crashes when attempting to register a duplicate ID. A remote attacker can trigger this by repeatedly connecting and requesting new xApp registrations.
- CVE-2026-37230High
FlexRIC v2.0.0 crashes when the near-RT RIC receives a RIC_INDICATION message with a non-existent ran_func_id. Debug builds assert (SIGABRT), Release builds NULL pointer dereference (SIGSEGV). A remote unauthenticated attacker can send a crafted message to port 36421.
- CVE-2026-37229High
FlexRIC v2.0.0 contains a reachable assertion in e2ap_create_pdu() triggered when ASN.1 PER decoding fails. A remote unauthenticated attacker can send any non-PER byte sequence over SCTP to crash the process via SIGABRT.
- CVE-2026-37228High
FlexRIC v2.0.0 has a reachable assertion in e2ap_recv_sctp_msg(). Sending a single SCTP message with payload >= 32768 bytes crashes near-RT RIC, iApp, E2 Agent, or xApp via SIGABRT. Release builds suffer integer overflow.
- CVE-2026-37226High
FlexRIC v2.0.0 crashes when the iApp receives an E42_RIC_SUBSCRIPTION_REQUEST referencing a non-existent E2 Node. The lookup returns NULL, causing assert (SIGABRT) in Debug or dereference (SIGSEGV) in Release. A remote unauthenticated attacker can send a request to port 36422.
- CVE-2026-37227High
FlexRIC v2.0.0 contains reachable assert(0) calls in stub message handlers for whitelisted but unimplemented E2AP message types in the near-RT RIC. A remote unauthenticated attacker can send a decodable E2AP PDU of such a type (e.g., E2nodeConfigurationUpdate) to crash the near-RT RIC process (port 36421) via SIGABRT.
- CVE-2026-37225High
FlexRIC v2.0.0 crashes when the iApp receives an E42_RIC_SUBSCRIPTION_REQUEST with an empty ricEventTriggerDefinition field. The E42 layer decoder accepts this as valid, but the E2AP encoder asserts a non-empty constraint when forwarding the request. A remote unauthenticated attacker can crash the iApp process (port 36422) via SIGABRT by exploiting this cross-layer validation mismatch.
Original NVD description (English source)
FlexRIC v2.0.0 crashes when receiving a RIC_SUBSCRIPTION_RESPONSE with an unknown ric_id that has no corresponding pending event. The near-RT RIC uses assert() to enforce the existence of a pending event during response processing. A remote unauthenticated attacker can send a forged RIC_SUBSCRIPTION_RESPONSE to the near-RT RIC (port 36421) to cause SIGABRT in Debug builds or NULL pointer dereference (SIGSEGV) in Release builds.