CVE-2026-37220 Details
Description
FlexRIC v2.0.0 crashes when an SCTP association is closed before an E2_SETUP_REQUEST is sent. The near-RT RIC assumes a mapping between SCTP association and E2 node always exists in the cleanup path and enforces this via assert(). A remote unauthenticated attacker can crash the near-RT RIC (port 36421) by simply completing an SCTP handshake and immediately disconnecting, without sending any E2AP message.
A denial-of-service vulnerability has been identified in EURECOM FlexRIC version 2.0.0. The issue arises when an SCTP association is closed before an E2_SETUP_REQUEST is sent, causing the near-RT RIC to crash. This occurs because the RIC expects a mapping between the SCTP association and the E2 node to always be present during the cleanup process. A remote unauthenticated attacker can exploit this vulnerability by completing an SCTP handshake, disconnecting immediately, and without sending any E2AP message, thereby causing the RIC process to terminate.
No upstream fix is currently available. Operators are advised to restrict SCTP access to trusted E2 nodes and avoid exposing port 36421 to untrusted networks.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jun 1, 2026CISA-ADP
Assessed Jun 1, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/MinamiKotor1/oran-security-advisories-zhongnan-luo/blob/main/advisories/CVE-2026-37220.md | [email protected] | AdvisoryExploitRemedy |
| https://gitlab.eurecom.fr/mosaic5g/flexric | [email protected] | ProductSource CodeVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-617 | Reachable Assertion | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| EURECOM FlexRIC | 2.0.0 (semver) |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 22, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 1, 2026 | CVE Modified | CISA-ADP |
| Jun 1, 2026 | New CVE Received | [email protected] |