CVE-2026-37228
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk47th percentile - higher than 47% of all known CVEs
Summary
FlexRIC v2.0.0 has a reachable assertion in e2ap_recv_sctp_msg(). Sending a single SCTP message with payload >= 32768 bytes crashes near-RT RIC, iApp, E2 Agent, or xApp via SIGABRT. Release builds suffer integer overflow.
Risk Assessment
A remote attacker can easily crash multiple FlexRIC components, leading to disruption of RAN services.
Recommendation
Update FlexRIC to a patched version. Restrict access to ports 36421 and 36422 and filter SCTP traffic.
Other vulnerabilities in FlexRIC
See all- CVE-2026-37234High
FlexRIC v2.0.0 allows binding multiple xapp_ids to a single SCTP connection by sending multiple E42_SETUP_REQUESTs. On disconnect, only the first registered xapp_id's resources are cleaned up, leaving stale entries. A remote attacker can exploit this to leak subscription state in the iApp, potentially causing resource exhaustion or state corruption.
- CVE-2026-37235High
FlexRIC v2.0.0 trusts the xapp_id field from E42 messages without binding it to the sender's SCTP association. A remote unauthenticated attacker can impersonate any xApp by sending requests to iApp (port 36422), causing misrouted responses and potentially crashing the victim xApp, RIC, or iApp due to state inconsistencies in the red-black tree.
- CVE-2026-37233High
In FlexRIC v2.0.0, an authorization bypass vulnerability exists in the iApp's xApp isolation mechanism. The function eq_xapp_ric_gen_id() in src/ric/iApp/xapp_ric_id.c compares m0->xapp_id against itself (m0->xapp_id) instead of the other argument (m1->xapp_id), effectively ignoring the xApp identity dimension. A malicious xApp connected to the iApp (port 36422) can delete any other xApp's subscriptions by sending an E42_RIC_SUBSCRIPTION_DELETE_REQUEST with a matching ric_gen_id.
- CVE-2026-37231High
FlexRIC v2.0.0 uses a uint16_t counter for xapp_id assignment but stores the value in uint32_t message fields. After 65,530+ E42_SETUP_REQUESTs, the 16-bit counter wraps around and produces duplicate xapp_ids. The iApp (port 36422) crashes when attempting to register a duplicate ID. A remote attacker can trigger this by repeatedly connecting and requesting new xApp registrations.
- CVE-2026-37230High
FlexRIC v2.0.0 crashes when the near-RT RIC receives a RIC_INDICATION message with a non-existent ran_func_id. Debug builds assert (SIGABRT), Release builds NULL pointer dereference (SIGSEGV). A remote unauthenticated attacker can send a crafted message to port 36421.
- CVE-2026-37229High
FlexRIC v2.0.0 contains a reachable assertion in e2ap_create_pdu() triggered when ASN.1 PER decoding fails. A remote unauthenticated attacker can send any non-PER byte sequence over SCTP to crash the process via SIGABRT.
- CVE-2026-37226High
FlexRIC v2.0.0 crashes when the iApp receives an E42_RIC_SUBSCRIPTION_REQUEST referencing a non-existent E2 Node. The lookup returns NULL, causing assert (SIGABRT) in Debug or dereference (SIGSEGV) in Release. A remote unauthenticated attacker can send a request to port 36422.
- CVE-2026-37227High
FlexRIC v2.0.0 contains reachable assert(0) calls in stub message handlers for whitelisted but unimplemented E2AP message types in the near-RT RIC. A remote unauthenticated attacker can send a decodable E2AP PDU of such a type (e.g., E2nodeConfigurationUpdate) to crash the near-RT RIC process (port 36421) via SIGABRT.
- CVE-2026-37225High
FlexRIC v2.0.0 crashes when the iApp receives an E42_RIC_SUBSCRIPTION_REQUEST with an empty ricEventTriggerDefinition field. The E42 layer decoder accepts this as valid, but the E2AP encoder asserts a non-empty constraint when forwarding the request. A remote unauthenticated attacker can crash the iApp process (port 36422) via SIGABRT by exploiting this cross-layer validation mismatch.
- CVE-2026-37224High
FlexRIC v2.0.0 crashes when receiving a duplicate E2_SETUP_REQUEST from the same or spoofed E2 Node. The iApp registry enforces node ID uniqueness via assert(), allowing a remote unauthenticated attacker to crash the iApp process via SIGABRT.
Original NVD description (English source)
FlexRIC v2.0.0 contains a reachable assertion in e2ap_recv_sctp_msg() (src/lib/ep/e2ap_ep.c). The function allocates a fixed 32KB receive buffer and enforces assert(rc < len) on the sctp_recvmsg() return value. A remote unauthenticated attacker can send a single SCTP message with payload >= 32,768 bytes to crash the near-RT RIC, iApp, E2 Agent, or xApp process via SIGABRT. No valid E2AP PDU is required. All four SCTP endpoint types (ports 36421 and 36422) share this vulnerable code path. In Release builds (NDEBUG), the stripped assertion leads to a signed-to-unsigned integer overflow and potential out-of-bounds read.