CVE-2026-37225: FlexRIC DOS Vulnerability

CVE-2026-37225 Overview

CVE-2026-37225 affects FlexRIC v2.0.0, an open-source Open RAN (O-RAN) RIC implementation maintained by EURECOM. The vulnerability allows a remote unauthenticated attacker to crash the iApp process listening on port 36422 by sending a malformed E42_RIC_SUBSCRIPTION_REQUEST message with an empty ricEventTriggerDefinition field. The E42 layer decoder treats the empty field as valid, but the downstream E2AP encoder enforces a non-empty constraint and aborts the process via SIGABRT. This cross-layer validation mismatch maps to [CWE-617: Reachable Assertion].

Critical Impact
A single unauthenticated network packet terminates the FlexRIC iApp process, disrupting RAN intelligent controller operations in 5G O-RAN deployments.

Affected Products

FlexRIC v2.0.0 (EURECOM Mosaic5G)
iApp component listening on TCP port 36422
E42 / E2AP message processing layer

Discovery Timeline

2026-06-01 - CVE-2026-37225 published to NVD
2026-06-01 - Last updated in NVD database

Technical Details for CVE-2026-37225

Vulnerability Analysis

FlexRIC implements the O-RAN E2 interface, which carries control and subscription messages between the Near-RT RIC and xApps/iApps. The E42 protocol layer wraps E2AP (E2 Application Protocol) messages for internal forwarding. When an E42_RIC_SUBSCRIPTION_REQUEST arrives, the E42 decoder parses the ASN.1 structure permissively and accepts an empty ricEventTriggerDefinition octet string.

When the request is forwarded internally, the E2AP encoder validates the same field against ASN.1 constraints requiring a non-empty value. The constraint check fails, the encoder triggers an assertion, and the process terminates with SIGABRT. No authentication is required, and the message is processed before any application-level validation occurs.

Root Cause

The root cause is inconsistent input validation between two protocol layers in the same process. The decoder and encoder enforce different constraints on the same ASN.1 field. The encoder uses assert() semantics to enforce constraints, which terminates the process rather than returning an error to the caller. The combination produces a reachable assertion reachable from untrusted network input.

Attack Vector

An attacker with network access to the iApp port (TCP 36422) sends a single crafted E42_RIC_SUBSCRIPTION_REQUEST containing a zero-length ricEventTriggerDefinition. No credentials, prior session, or user interaction is required. The iApp process aborts, breaking subscription handling for connected xApps and disrupting RIC control plane operations until the process is restarted.

No public proof-of-concept exploit code is published. Technical detail is available in the GitHub CVE-2026-37225 Advisory and the GitLab FlexRIC Repository.

Detection Methods for CVE-2026-37225

Indicators of Compromise

Unexpected SIGABRT termination of the FlexRIC iApp process with assertion failure messages referencing E2AP encoder constraints
Inbound TCP connections to port 36422 from hosts outside the trusted RIC management network
E42_RIC_SUBSCRIPTION_REQUEST messages containing zero-length ricEventTriggerDefinition fields in packet captures

Detection Strategies

Inspect E2AP/E42 traffic on port 36422 for subscription requests with empty event trigger definitions using a protocol-aware decoder
Monitor host logs for repeated iApp process crashes followed by service restarts within short intervals
Correlate process termination events on RIC hosts with inbound network flows to identify external triggers

Monitoring Recommendations

Enable core dump collection on FlexRIC hosts to capture assertion context for forensic review
Forward iApp stderr and systemd journal logs to a centralized log platform for crash pattern analysis
Alert on any traffic to port 36422 originating outside an explicit allowlist of RIC component IPs

How to Mitigate CVE-2026-37225

Immediate Actions Required

Restrict network access to TCP port 36422 to authorized RIC components using host firewalls or network ACLs
Place FlexRIC deployments behind a segmented management VLAN with no exposure to untrusted networks
Add process supervision (systemd, supervisord) to automatically restart the iApp after a crash to limit downtime

Patch Information

No official patch identifier is referenced in the NVD entry at publication. Monitor the GitLab FlexRIC Repository for upstream fixes that align the E42 decoder validation with the E2AP encoder constraints, and apply updates as they are released by EURECOM.

Workarounds

Apply a local patch that rejects E42_RIC_SUBSCRIPTION_REQUEST messages with an empty ricEventTriggerDefinition at the decoder layer before forwarding to the E2AP encoder
Deploy a network filter or proxy in front of the iApp that drops malformed E42 subscription requests
Limit FlexRIC v2.0.0 to lab or isolated test environments until a vendor fix is available

bash

# Restrict iApp port 36422 to trusted RIC subnet only
sudo iptables -A INPUT -p tcp --dport 36422 -s 10.0.10.0/24 -j ACCEPT
sudo iptables -A INPUT -p tcp --dport 36422 -j DROP