CVE-2026-37222 Overview
CVE-2026-37222 is a denial-of-service vulnerability in FlexRIC v2.0.0, an open-source Open RAN (O-RAN) near-real-time RAN Intelligent Controller (near-RT RIC) developed by EURECOM. The flaw resides in the E2 Application Protocol (E2AP) message decoder, which uses hardcoded assert() statements to validate Information Element (IE) counts in decoded Protocol Data Units (PDUs). A remote unauthenticated attacker can send a syntactically valid E2AP PDU containing an unexpected number of IEs to trigger SIGABRT and crash the service. Both the near-RT RIC listener on port 36421 and the iApp listener on port 36422 are affected. The issue is classified under [CWE-617] Reachable Assertion.
Critical Impact
A single crafted E2AP PDU from an unauthenticated network attacker terminates the near-RT RIC process, disrupting RAN control plane operations.
Affected Products
- FlexRIC v2.0.0 (EURECOM MOSAIC5G)
- near-RT RIC component (TCP port 36421)
- iApp component (TCP port 36422)
Discovery Timeline
- 2026-06-01 - CVE-2026-37222 published to NVD
- 2026-06-01 - Last updated in NVD database
Technical Details for CVE-2026-37222
Vulnerability Analysis
FlexRIC implements the O-RAN E2AP specification to exchange control messages between the near-RT RIC and E2 nodes such as gNBs. E2AP PDUs are ASN.1-encoded structures containing variable lists of Information Elements. Several IEs in messages like E2setupRequest are defined as optional or carry protocol-specified cardinality ranges.
FlexRIC's decoder validates the decoded IE list using hardcoded assert() calls that require an exact count. When a peer transmits a PDU containing additional valid optional IEs, the assertion fails. The C runtime then calls abort(), delivering SIGABRT to the process and terminating it.
Because E2AP listeners on ports 36421 and 36422 accept connections prior to any application-layer authentication, the crash is triggered remotely without credentials. Restarting the controller does not remediate the condition; the attacker can replay the PDU to crash the service repeatedly.
Root Cause
The root cause is improper input validation [CWE-617]. The code uses assert() as a protocol-conformance check rather than as a developer invariant. Assertions terminate the process on failure and are inappropriate for validating attacker-controlled network input. Correct handling requires range-based validation against the E2AP ASN.1 schema and graceful rejection of non-conforming PDUs.
Attack Vector
The attack vector is network-based and unauthenticated. An attacker with reachability to TCP 36421 or 36422 establishes a SCTP/TCP session, completes the E2AP transport handshake, and transmits an E2setupRequest (or equivalent) PDU containing extra optional IEs. The decoder reaches the assertion, abort() fires, and the process exits. Refer to the GitHub Security Advisory for the proof-of-concept details.
No verified exploit code is published. The vulnerability mechanism is described in prose; consult the upstream GitLab Project Repository for the affected decoder sources.
Detection Methods for CVE-2026-37222
Indicators of Compromise
- Unexpected SIGABRT termination of the FlexRIC near-RT RIC or iApp process with core dumps referencing E2AP decode functions.
- Repeated short-lived inbound connections to TCP ports 36421 or 36422 from non-E2-node sources.
- Gaps in RIC-to-E2-node heartbeat telemetry coinciding with process restarts.
Detection Strategies
- Monitor process exit codes and systemd or supervisor restart events for the FlexRIC binary and alert on abnormal frequency.
- Inspect SCTP/TCP flows to E2AP ports for sessions that terminate immediately after the first PDU exchange.
- Deploy network IDS signatures that parse E2AP and flag PDUs whose IE counts exceed FlexRIC's hardcoded expectations.
Monitoring Recommendations
- Forward FlexRIC stdout/stderr and core-dump notifications to a central log pipeline for correlation.
- Track baseline connection sources for ports 36421 and 36422 and alert on any new peer IP.
- Track E2setupRequest failure rates and unscheduled controller restarts as service-level indicators.
How to Mitigate CVE-2026-37222
Immediate Actions Required
- Restrict network access to TCP ports 36421 and 36422 to known E2 nodes using host firewalls or network ACLs.
- Place the near-RT RIC behind a segmented management network and block external reachability.
- Enable automatic process supervision so the controller restarts after a crash, reducing dwell time while a patch is pending.
Patch Information
No vendor-supplied patch is referenced in the NVD record at publication. Track the GitLab Project Repository and the GitHub Security Advisory for upstream fixes. The remediation requires replacing assert()-based IE count checks with range-based validation and explicit error returns aligned with the E2AP ASN.1 schema.
Workarounds
- Apply strict IP allow-lists at the SCTP/TCP layer so only trusted E2 nodes can initiate sessions.
- Deploy a protocol-aware proxy or middlebox that rejects E2AP PDUs with IE counts outside expected ranges before they reach FlexRIC.
- Disable the iApp listener on port 36422 if iApps are not in use to reduce exposed attack surface.
# Configuration example: restrict E2AP listeners to trusted E2 nodes
iptables -A INPUT -p tcp --dport 36421 -s 10.0.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 36422 -s 10.0.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 36421 -j DROP
iptables -A INPUT -p tcp --dport 36422 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
