CVE-2026-37221: FlexRIC v2.0.0 Denial of Service Vulnerability

CVE-2026-37221 Overview

CVE-2026-37221 is a denial-of-service vulnerability in FlexRIC v2.0.0, an Open RAN (O-RAN) near real-time RAN Intelligent Controller (near-RT RIC) developed by EURECOM. The flaw resides in the handling of RIC_SUBSCRIPTION_RESPONSE messages. When the near-RT RIC receives a response containing an unknown ric_id with no corresponding pending event, an assert() call enforcing the existence of that event terminates the process. A remote unauthenticated attacker can transmit a forged RIC_SUBSCRIPTION_RESPONSE to TCP port 36421 to trigger SIGABRT in Debug builds or a SIGSEGV (NULL pointer dereference) in Release builds. The defect is classified under [CWE-617] Reachable Assertion.

Critical Impact
Unauthenticated remote attackers can crash the near-RT RIC, disrupting O-RAN control-plane operations and dependent xApps.

Affected Products

FlexRIC v2.0.0
EURECOM Mosaic5G FlexRIC near-RT RIC component
Deployments exposing the E2AP listener on TCP port 36421

Discovery Timeline

2026-06-01 - CVE-2026-37221 published to NVD
2026-06-01 - Last updated in NVD database

Technical Details for CVE-2026-37221

Vulnerability Analysis

FlexRIC implements the O-RAN E2 Application Protocol (E2AP) to exchange subscription, indication, and control messages with E2 nodes such as gNBs and eNBs. During normal operation, an xApp issues a RIC_SUBSCRIPTION_REQUEST and the near-RT RIC tracks a pending event keyed by ric_id. When the corresponding RIC_SUBSCRIPTION_RESPONSE arrives, the RIC matches it to the pending event and completes the transaction.

The vulnerability stems from using assert() as a runtime control mechanism rather than a defensive programming check. The response handler assumes a pending event always exists for any inbound ric_id. An attacker supplying a ric_id value that does not map to any pending subscription violates this assumption.

In Debug builds the failed assertion raises SIGABRT and terminates the RIC process. In Release builds the assertion is compiled out, and the unchecked lookup returns a NULL pointer that is subsequently dereferenced, producing SIGSEGV. Both outcomes crash the near-RT RIC and break service for all connected xApps and E2 nodes.

Root Cause

The root cause is improper input validation combined with the use of assert() to validate untrusted network input. The pending-event lookup result is not checked before use, and protocol-layer authentication on E2AP port 36421 is not enforced, allowing arbitrary peers to deliver crafted responses.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker with reachability to TCP port 36421 establishes an SCTP/TCP session and emits a single forged RIC_SUBSCRIPTION_RESPONSE containing an arbitrary ric_id. The near-RT RIC processes the message, fails the assertion or dereferences NULL, and terminates. Repeated injection prevents recovery and produces a sustained denial of service.

Detection Methods for CVE-2026-37221

Indicators of Compromise

Unexpected SIGABRT or SIGSEGV crashes of the FlexRIC near-RT RIC process with stack frames in the RIC_SUBSCRIPTION_RESPONSE handler.
Core dumps referencing assertion failures tied to pending-event lookups.
Inbound E2AP traffic to TCP port 36421 originating from peers not registered as legitimate E2 nodes.
Repeated restart cycles of FlexRIC containers or systemd units shortly after external connections to port 36421.

Detection Strategies

Inspect E2AP message flows for RIC_SUBSCRIPTION_RESPONSE PDUs that do not correlate with a preceding RIC_SUBSCRIPTION_REQUEST from the same peer.
Correlate process crash events with network session logs to identify the source IP delivering the malformed response.
Deploy network IDS signatures that flag E2AP responses carrying ric_id values absent from observed request state.

Monitoring Recommendations

Continuously monitor near-RT RIC process health and restart counts through host telemetry.
Log and alert on all new TCP connections to port 36421 from outside the trusted O-RAN management segment.
Capture and retain SCTP/TCP packet metadata on E2AP interfaces to support post-incident reconstruction.

How to Mitigate CVE-2026-37221

Immediate Actions Required

Restrict network access to TCP port 36421 so only authenticated E2 nodes on a trusted management VLAN can connect.
Place the near-RT RIC behind a firewall or service mesh policy that drops E2AP traffic from unknown peers.
Enable process supervision with rate-limited restart to limit the blast radius of a single crash, while recognizing repeated exploitation will still cause outages.

Patch Information

No official patched release is identified in the published advisory. Refer to the GitHub Security Advisory and the upstream GitLab Project Repository for fix status and remediation commits. Operators should replace assert() checks on network-derived state with explicit error handling that discards unmatched RIC_SUBSCRIPTION_RESPONSE messages.

Workarounds

Apply IPsec or DTLS/SCTP authentication on the E2 interface to prevent unauthenticated peers from reaching the listener.
Deploy network ACLs allow-listing only known E2 node addresses to port 36421.
Run FlexRIC in Release builds while patching is unavailable to avoid SIGABRT, recognizing that SIGSEGV from NULL dereference remains possible.
Add an upstream proxy that validates E2AP message correlation before forwarding to the near-RT RIC.

bash

# Example iptables restriction limiting E2AP port 36421 to a trusted E2 node subnet
iptables -A INPUT -p tcp --dport 36421 -s 10.20.30.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 36421 -j DROP