CVE-2026-37223: FlexRIC v2.0.0 DoS Vulnerability

CVE-2026-37223 Overview

CVE-2026-37223 is a reachable assertion vulnerability in FlexRIC v2.0.0, an open-source Open RAN (O-RAN) near-real-time RAN Intelligent Controller (near-RT RIC) implementation. The flaw exists in the iApp message dispatcher, which validates incoming E2 Application Protocol (E2AP) messages against a 9-entry whitelist using assert(). A remote unauthenticated attacker can send any decodable E2AP PDU with a message type outside the whitelist to trigger SIGABRT and crash the iApp process listening on port 36422. Because iApp and the near-RT RIC share a single process, the entire RIC service terminates, disconnecting all E2 Nodes and xApps.

Critical Impact
A single unauthenticated E2AP PDU can crash the entire near-RT RIC, severing connectivity to every E2 Node and xApp managed by the controller.

Affected Products

FlexRIC v2.0.0 (Eurecom Mosaic5G)
iApp message dispatcher component (port 36422)
Co-located near-RT RIC service sharing the iApp process

Discovery Timeline

2026-06-01 - CVE-2026-37223 published to the National Vulnerability Database
2026-06-01 - Last updated in NVD database

Technical Details for CVE-2026-37223

Vulnerability Analysis

The vulnerability is classified under [CWE-617] (Reachable Assertion). The iApp dispatcher in FlexRIC v2.0.0 decodes incoming E2AP Protocol Data Units (PDUs) and then validates the message type by comparing it against a fixed 9-entry whitelist of expected procedure codes. The validation uses the C assert() macro rather than a defensive error-return path.

When the message type does not match any whitelisted value, the assertion fails and the C runtime raises SIGABRT, terminating the process. The dispatcher is reachable before any authentication or transport-layer authorization step, so attacker-controlled input drives the assertion directly.

Because FlexRIC compiles the iApp service and the near-RT RIC into a single Unix process, the abort affects both components. All Stream Control Transmission Protocol (SCTP) sessions with connected E2 Nodes and Inter-Process Communication (IPC) channels with xApps drop simultaneously, producing a service-wide outage of the O-RAN control plane.

Root Cause

The root cause is the use of assert() for runtime input validation on untrusted network data. Assertions are intended for invariants that must hold during development, not for sanitizing remote protocol fields. Any E2AP procedure code outside the 9 expected values triggers process abort instead of returning a protocol error response.

Attack Vector

An attacker reaches the iApp dispatcher over the network on TCP/SCTP port 36422 without credentials, user interaction, or prior session state. The attacker crafts a syntactically valid E2AP PDU using the standard ASN.1 encoding, sets the procedureCode field to any value outside the whitelist, and transmits it to the RIC endpoint. The dispatcher decodes the PDU, fails the whitelist assertion, and the process aborts. Refer to the GitHub Security Advisory CVE-2026-37223 for the message structure details.

Detection Methods for CVE-2026-37223

Indicators of Compromise

Unexpected SIGABRT termination of the FlexRIC nearRT-RIC or iApp process with assertion failure messages in stderr or systemd journal logs.
Simultaneous disconnection of all E2 Nodes and xApps from the controller within a short time window.
Inbound E2AP traffic to port 36422 from sources outside the documented E2 Node inventory.

Detection Strategies

Monitor process supervisor logs (systemd, journalctl) for repeated FlexRIC restarts and abort signals.
Inspect SCTP/TCP traffic on port 36422 for E2AP PDUs carrying procedure codes outside the published O-RAN WG3 specification range.
Correlate RIC process exits with sudden drops in E2 setup request counts and xApp subscription state.

Monitoring Recommendations

Enable core dump collection on RIC hosts to capture stack traces showing the assert() site after a crash.
Forward FlexRIC stderr and systemd unit logs to a centralized logging pipeline for alerting on Assertion .* failed patterns.
Track E2 Node session counts and alert when more than one session terminates within the same second, indicating service-wide collapse rather than individual node failure.

How to Mitigate CVE-2026-37223

Immediate Actions Required

Restrict network access to TCP/SCTP port 36422 to the IP addresses of trusted E2 Nodes using host firewalls or network access control lists.
Deploy FlexRIC on a dedicated management VLAN isolated from general-purpose and untrusted networks.
Configure a process supervisor (systemd, supervisord) to automatically restart the RIC on abort to reduce outage duration while a patch is pending.

Patch Information

No fixed version is published in the NVD entry at the time of disclosure. Operators should monitor the GitLab FlexRIC Project Repository for commits replacing assert() calls in the iApp dispatcher with proper error-handling paths that return E2AP error indications instead of aborting the process.

Workarounds

Apply network segmentation and SCTP/TCP access controls to limit which hosts can transmit E2AP PDUs to the RIC.
Run FlexRIC inside a container or namespace with an automatic restart policy to limit downtime from any successful abort.
Patch the source locally by replacing the whitelist assert() in the iApp dispatcher with a conditional that logs the unknown procedure code and drops the PDU.

bash

# Restrict E2AP port 36422 to known E2 Node subnet using iptables
sudo iptables -A INPUT -p tcp --dport 36422 -s 10.10.20.0/24 -j ACCEPT
sudo iptables -A INPUT -p sctp --dport 36422 -s 10.10.20.0/24 -j ACCEPT
sudo iptables -A INPUT -p tcp --dport 36422 -j DROP
sudo iptables -A INPUT -p sctp --dport 36422 -j DROP