CVE-2026-37224 Overview
CVE-2026-37224 is a denial-of-service vulnerability affecting FlexRIC v2.0.0, an open-source near-real-time RAN Intelligent Controller (Near-RT RIC) used in O-RAN deployments. The flaw resides in the iApp registry, which enforces E2 Node ID uniqueness through an assert() call rather than a graceful rejection path. A remote unauthenticated attacker can send two E2_SETUP_REQUEST messages with identical E2 node configuration to TCP port 36421, triggering SIGABRT and crashing the iApp process. The vulnerability is classified under CWE-617: Reachable Assertion.
Critical Impact
Unauthenticated remote attackers can crash the FlexRIC iApp process by spoofing or replaying a single E2 setup exchange, disrupting Near-RT RIC control of connected E2 Nodes.
Affected Products
- FlexRIC v2.0.0 (EURECOM Mosaic5G)
- Deployments exposing the iApp service on TCP port 36421
- O-RAN environments relying on FlexRIC for Near-RT RIC functions
Discovery Timeline
- 2026-06-01 - CVE-2026-37224 published to NVD
- 2026-06-01 - Last updated in NVD database
Technical Details for CVE-2026-37224
Vulnerability Analysis
FlexRIC implements the O-RAN E2 Application Protocol (E2AP) to communicate with E2 Nodes such as gNBs and eNBs. When an E2 Node initiates a session, it sends an E2_SETUP_REQUEST containing its globally unique E2 Node ID. The iApp registry stores this ID and expects subsequent registrations to use distinct identifiers.
Instead of returning an E2_SETUP_FAILURE response when a duplicate ID is observed, the code path invokes a debug-style assert() to validate uniqueness. The failed assertion raises SIGABRT, terminating the iApp process and severing the control channel to every connected E2 Node. The iApp listener on TCP 36421 does not require authentication, so any host able to reach the port can trigger the condition.
Root Cause
The root cause is the misuse of assert() as an input-validation primitive on attacker-controlled data [CWE-617]. Assertions are intended to verify invariants that should hold under all correct program states, not to validate untrusted network input. Because the duplicate node ID condition is reachable from the network, the assertion converts an expected protocol error into a fatal process abort.
Attack Vector
Exploitation requires no privileges, no user interaction, and only network reachability to the iApp listener. An attacker establishes an SCTP/TCP session to port 36421, sends a valid E2_SETUP_REQUEST, and then sends a second E2_SETUP_REQUEST carrying the same Global E2 Node ID (Type, PLMN-ID, and Node-ID fields). The duplicate triggers the assertion failure and crashes the process. The same outcome can be reached by spoofing the identifier of a legitimate E2 Node that is already registered.
No verified proof-of-concept code is published. See the GitHub Security Advisory CVE-2026-37224 and the FlexRIC GitLab repository for protocol-level details.
Detection Methods for CVE-2026-37224
Indicators of Compromise
- Unexpected SIGABRT termination of the FlexRIC iApp process with assertion failure messages in stderr or systemd journal logs.
- Repeated E2_SETUP_REQUEST messages on TCP port 36421 originating from the same source within a short interval.
- Sudden disconnection of all registered E2 Nodes from the Near-RT RIC following an inbound setup exchange.
Detection Strategies
- Monitor process supervision logs for abnormal exits of the iApp binary and correlate with inbound connections on port 36421.
- Inspect E2AP traffic for two or more E2_SETUP_REQUEST PDUs sharing an identical Global E2 Node ID from different source addresses.
- Alert on E2 Node ID values that arrive from network paths inconsistent with the legitimate gNB/eNB topology.
Monitoring Recommendations
- Collect FlexRIC stdout, stderr, and core dump artifacts to a centralized log store for post-crash analysis.
- Track session counts and reconnect storms against the iApp endpoint as a signal of repeated exploitation attempts.
- Baseline expected E2 Node identifiers and flag any deviation or duplication observed in protocol telemetry.
How to Mitigate CVE-2026-37224
Immediate Actions Required
- Restrict network access to TCP port 36421 so only authorized E2 Nodes from the trusted RAN segment can reach the iApp listener.
- Place the FlexRIC iApp behind a firewall or service mesh policy that enforces source-address allowlists.
- Enable automatic process restart for the iApp service to reduce downtime if a crash occurs.
Patch Information
At the time of NVD publication on 2026-06-01, no fixed FlexRIC release is referenced in the advisory. Operators should monitor the FlexRIC GitLab repository and the GitHub Security Advisory for an upstream fix that replaces the assert() with a graceful E2_SETUP_FAILURE response.
Workarounds
- Segment the Near-RT RIC management plane on a dedicated VLAN or VRF that excludes untrusted hosts.
- Apply IPsec or mutual TLS between E2 Nodes and FlexRIC to prevent spoofed E2_SETUP_REQUEST messages from unauthorized peers.
- Configure a process supervisor such as systemd with Restart=always and a short RestartSec to recover the iApp service after a crash.
- Rate-limit inbound connections to port 36421 at the firewall to slow repeated exploitation attempts.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
