CVE-2026-37229 Details
Description
FlexRIC v2.0.0 contains a reachable assertion in e2ap_create_pdu() triggered when ASN.1 PER decoding fails. A remote unauthenticated attacker can send any non-PER byte sequence (e.g., a single 0x00 byte) over SCTP to the near-RT RIC (port 36421) or iApp (port 36422) to crash the process via SIGABRT. The assertion is reached before any protocol-level validation occurs. All three E2AP protocol versions (v1.01, v2.03, v3.01) are affected.
A reachable assertion vulnerability has been identified in EURECOM FlexRIC version 2.0.0. This vulnerability occurs in the E2AP message decoding process when the ASN.1 Packed Encoding Rules (PER) decoding fails. A remote, unauthenticated attacker can exploit this issue by sending any non-PER byte sequence, such as a single byte with the value 0x00, over the Stream Control Transmission Protocol (SCTP) to the near-RT RIC on port 36421 or to the iApp on port 36422. The vulnerability leads to a process crash via a SIGABRT signal. All three E2AP protocol versions (v1.01, v2.03, v3.01) are affected.
No upstream fix was available at the time of publication. Operators are advised to restrict SCTP access to trusted peers and to handle decode failures as normal malformed input by rejecting or dropping the message, rather than asserting.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jun 2, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/MinamiKotor1/oran-security-advisories-zhongnan-luo/blob/main/advisories/CVE-2026-37229.md | [email protected] | ExploitMitigationThird Party Advisory |
| https://gitlab.eurecom.fr/mosaic5g/flexric | [email protected] | Product |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-617 | Reachable Assertion | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| mosaic5g flexric | 2.0.0 |
CPE
Remediation
| |
Change History
6 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 22, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 3, 2026 | Initial Analysis | [email protected] |
| Jun 2, 2026 | CVE Modified | CISA-ADP |
| Jun 1, 2026 | New CVE Received | [email protected] |