CVE-2026-37220: FlexRIC DoS Vulnerability via SCTP

CVE-2026-37220 Overview

CVE-2026-37220 affects FlexRIC v2.0.0, an open-source near Real-Time RAN Intelligent Controller (near-RT RIC) used in Open RAN (O-RAN) deployments. The vulnerability allows a remote unauthenticated attacker to crash the near-RT RIC service on port 36421 by completing a Stream Control Transmission Protocol (SCTP) handshake and disconnecting before sending any E2 Application Protocol (E2AP) message. The flaw is a reachable assert() call ([CWE-617]) in the SCTP cleanup path, where FlexRIC assumes that an SCTP association is always mapped to an E2 node.

Critical Impact
An unauthenticated remote attacker can crash the FlexRIC near-RT RIC service by initiating and immediately closing an SCTP connection, disrupting RAN control plane operations.

Affected Products

FlexRIC v2.0.0 (Mosaic5G / EURECOM)
Near-RT RIC component listening on SCTP port 36421
O-RAN deployments integrating FlexRIC v2.0.0 as the near-RT RIC

Discovery Timeline

2026-06-01 - CVE-2026-37220 published to NVD
2026-06-01 - Last updated in NVD database

Technical Details for CVE-2026-37220

Vulnerability Analysis

FlexRIC implements the E2 interface between the near-RT RIC and E2 nodes over SCTP. When an E2 node connects, FlexRIC creates a mapping between the SCTP association identifier and the corresponding E2 node context once an E2_SETUP_REQUEST message is received. The cleanup routine invoked on SCTP disconnect assumes this mapping always exists and enforces the invariant with an assert() statement.

If a peer completes the SCTP four-way handshake and tears down the association before sending any E2AP message, no mapping is ever created. The assertion fails, terminating the near-RT RIC process. The crash requires no authentication, no credentials, and no protocol-level interaction beyond a standard SCTP handshake.

This is a reachable assertion failure resulting in denial of service. It falls under [CWE-617] Reachable Assertion. Confidentiality and integrity are not affected; availability is fully compromised for the near-RT RIC service.

Root Cause

The root cause is an unchecked assumption in the SCTP disconnect handler. FlexRIC treats the presence of an SCTP association as a guarantee that an E2 node mapping has been registered. Because mapping registration happens only after E2 setup, any association closed before E2_SETUP_REQUEST violates the invariant and triggers assert().

Attack Vector

The attack is network-reachable with low complexity. An attacker connects to TCP-style SCTP port 36421 on the near-RT RIC, completes the SCTP INIT / INIT-ACK / COOKIE-ECHO / COOKIE-ACK handshake, then issues an SCTP SHUTDOWN or ABORT. The near-RT RIC process crashes during cleanup. The attacker can repeat the connection to prevent service recovery if the process is restarted by a supervisor.

No E2AP payload, no malformed packet, and no authentication are needed. See the GitHub Security Advisory CVE-2026-37220 for the detailed analysis and the GitLab FlexRIC Project Repository for source code references.

Detection Methods for CVE-2026-37220

Indicators of Compromise

Unexpected termination of the FlexRIC nearRT-RIC process with an assertion failure logged to stderr or the process supervisor journal.
SCTP associations to port 36421 that complete the handshake and close without any E2AP payload exchanged.
Repeated short-lived SCTP connections from non-allowlisted source addresses targeting the near-RT RIC.

Detection Strategies

Monitor process exit codes and core dumps for the FlexRIC near-RT RIC binary and alert on SIGABRT from assertion failures.
Inspect SCTP flow records on port 36421 for sessions with zero E2AP DATA chunks between INIT and SHUTDOWN.
Correlate near-RT RIC service restarts with inbound SCTP connection metadata to identify abusive sources.

Monitoring Recommendations

Enable verbose logging in FlexRIC to capture SCTP association lifecycle events and the originating peer address.
Deploy network telemetry on the E2 interface to record SCTP handshake completion and teardown timings.
Alert on a rising rate of FlexRIC process restarts within the orchestration layer (Kubernetes, systemd, Docker).

How to Mitigate CVE-2026-37220

Immediate Actions Required

Restrict SCTP access to port 36421 using a host firewall or network ACL so only known E2 node addresses can reach the near-RT RIC.
Place the near-RT RIC behind a segmented O-RAN management network rather than exposing it to untrusted networks.
Configure the process supervisor to restart FlexRIC automatically and rate-limit restart loops to maintain availability during attack attempts.

Patch Information

At publication, no fixed release was identified in the NVD record for FlexRIC v2.0.0. Track upstream commits in the GitLab FlexRIC Project Repository and the GitHub Security Advisory CVE-2026-37220 for the official fix. The remediation requires replacing the assert() in the SCTP cleanup path with a defensive check that handles associations without an E2 node mapping.

Workarounds

Apply strict source-address filtering on the SCTP listener using iptables or nftables SCTP modules to allow only trusted E2 nodes.
Deploy the near-RT RIC inside a private VLAN or VPN with no exposure to operator or public networks.
Use a watchdog or systemd unit with Restart=on-failure and RestartSec tuning to recover the service quickly after a crash.

bash

# Example nftables rule to restrict SCTP port 36421 to trusted E2 nodes
nft add table inet flexric
nft add chain inet flexric input { type filter hook input priority 0 \; policy drop \; }
nft add rule inet flexric input ip saddr { 10.10.0.10, 10.10.0.11 } sctp dport 36421 accept
nft add rule inet flexric input sctp dport 36421 drop