CVE-2026-37221 Details
Description
FlexRIC v2.0.0 crashes when receiving a RIC_SUBSCRIPTION_RESPONSE with an unknown ric_id that has no corresponding pending event. The near-RT RIC uses assert() to enforce the existence of a pending event during response processing. A remote unauthenticated attacker can send a forged RIC_SUBSCRIPTION_RESPONSE to the near-RT RIC (port 36421) to cause SIGABRT in Debug builds or NULL pointer dereference (SIGSEGV) in Release builds.
A denial-of-service vulnerability has been identified in EURECOM FlexRIC version 2.0.0. The issue arises in the near-RT RIC component when it receives a RIC_SUBSCRIPTION_RESPONSE containing an unknown ric_id without a corresponding pending event. The response handling process, which relies on an assertion to verify the existence of a pending event, fails and causes the application to crash. This vulnerability can be exploited by a remote, unauthenticated attacker who sends a forged RIC_SUBSCRIPTION_RESPONSE over SCTP to port 36421.
No upstream fix is currently available. Operators are advised to restrict SCTP access to trusted E2 nodes. The response handler should be modified to verify the existence of a pending event before processing subscription responses, and to reject unknown, replayed, or out-of-order responses without causing a crash.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jun 1, 2026CISA-ADP
Assessed Jun 1, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/MinamiKotor1/oran-security-advisories-zhongnan-luo/blob/main/advisories/CVE-2026-37221.md | [email protected] | AdvisoryTechnical Description |
| https://gitlab.eurecom.fr/mosaic5g/flexric | [email protected] | ProductSource CodeVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-617 | Reachable Assertion | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| EURECOM FlexRIC | 2.0.0 (semver) 6a595d8b |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 22, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 1, 2026 | CVE Modified | CISA-ADP |
| Jun 1, 2026 | New CVE Received | [email protected] |