CVE-2026-37222 Details
Description
FlexRIC v2.0.0 uses hardcoded assertions to validate Information Element (IE) counts in decoded E2AP messages. A remote unauthenticated attacker can send a valid E2AP PDU containing an unexpected number of IEs (e.g., an E2setupRequest with extra optional fields) to crash the near-RT RIC (port 36421) or iApp (port 36422) via SIGABRT. The code asserts exact IE counts rather than validating against protocol-specified ranges.
A denial-of-service vulnerability has been identified in FlexRIC version 2.0.0. The issue arises from hardcoded assertions that validate Information Element (IE) counts in decoded E2AP messages. A remote unauthenticated attacker can exploit this vulnerability by sending a valid E2AP Protocol Data Unit (PDU) with an unexpected number of IEs, such as an E2setupRequest containing extra optional fields. This exploitation causes the near-RT RIC or iApp process to crash by terminating the process with a SIGABRT signal. The vulnerability exists because the decoder asserts exact IE counts instead of validating them against protocol-specified ranges, allowing variations in E2AP messages to be manipulated into causing a process-level crash.
No upstream fix is currently available. Operators are advised to limit SCTP access to trusted peers and to modify the E2AP message decoder to validate IE counts against protocol-allowed ranges, returning a protocol error for unsupported message variants instead of using assertions.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jun 1, 2026CISA-ADP
Assessed Jun 1, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/MinamiKotor1/oran-security-advisories-zhongnan-luo/blob/main/advisories/CVE-2026-37222.md | [email protected] | AdvisoryExploitRemedy |
| https://gitlab.eurecom.fr/mosaic5g/flexric | [email protected] | ProductSource CodeVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-617 | Reachable Assertion | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| EURECOM FlexRIC | >= 2.0.0, <= 6a595d8b |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 22, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 1, 2026 | CVE Modified | CISA-ADP |
| Jun 1, 2026 | New CVE Received | [email protected] |