CVE-2026-37226 Overview
CVE-2026-37226 is a null pointer dereference vulnerability [CWE-476] in Mosaic5g FlexRIC v2.0.0, an open-source Near-Real-Time RAN Intelligent Controller (Near-RT RIC) used in Open RAN (O-RAN) deployments. The iApp component crashes when it receives an E42_RIC_SUBSCRIPTION_REQUEST referencing a non-existent E2 Node. The internal lookup function returns NULL, which is enforced by assert() in Debug builds (SIGABRT) and dereferenced in Release builds (SIGSEGV). A remote unauthenticated attacker can crash the iApp process listening on port 36422 by sending a subscription request with an arbitrary global_e2_node_id.
Critical Impact
Remote unauthenticated attackers can crash the FlexRIC iApp process and disrupt Near-RT RIC operations in O-RAN deployments.
Affected Products
- Mosaic5g FlexRIC v2.0.0
- FlexRIC iApp component (TCP port 36422)
- O-RAN deployments relying on FlexRIC as the Near-RT RIC
Discovery Timeline
- 2026-06-01 - CVE-2026-37226 published to NVD
- 2026-06-03 - Last updated in NVD database
Technical Details for CVE-2026-37226
Vulnerability Analysis
FlexRIC implements the E2 interface defined by the O-RAN Alliance to connect a Near-RT RIC to E2 Nodes such as gNBs and eNBs. The iApp service accepts E42_RIC_SUBSCRIPTION_REQUEST messages over TCP port 36422. Each request contains a global_e2_node_id identifying the target E2 Node for the subscription. The iApp resolves this identifier by querying an internal registry of connected E2 Nodes.
When the supplied global_e2_node_id does not correspond to any registered E2 Node, the lookup function returns a NULL pointer. The calling code does not validate the return value before using it. In Debug builds, an assert() macro detects the null pointer and aborts the process with SIGABRT. In Release builds, the pointer is dereferenced directly, producing a segmentation fault (SIGSEGV). Either outcome terminates the iApp process and disrupts RIC operations.
Root Cause
The root cause is missing input validation on the result of the E2 Node lookup. The code path assumes the requested node exists in the registry and does not check for a null return value before dereferencing it. Subscription requests are accepted before any authentication or membership check confirms that the requested E2 Node ID is valid.
Attack Vector
An attacker with network access to TCP port 36422 sends a crafted E42_RIC_SUBSCRIPTION_REQUEST containing an arbitrary global_e2_node_id that is not present in the registry. No authentication or prior session is required. The iApp process aborts on the malformed lookup, breaking subscriptions for legitimate E2 Nodes and halting RIC-driven xApp logic until the service is restarted.
See the GitHub Security Advisory CVE-2026-37226 for protocol-level details.
Detection Methods for CVE-2026-37226
Indicators of Compromise
- Unexpected termination of the FlexRIC iApp process with SIGSEGV or SIGABRT signals in system logs or core dumps.
- Inbound TCP connections to port 36422 from hosts that are not authorized E2 Nodes.
- E42_RIC_SUBSCRIPTION_REQUEST messages containing global_e2_node_id values that do not match any registered gNB or eNB.
- Repeated restart events for the iApp service correlated with external network traffic.
Detection Strategies
- Monitor for process crashes and segmentation faults on hosts running FlexRIC, with alerts on iApp restart loops.
- Inspect E2 interface traffic for malformed or unauthorized subscription requests using protocol-aware sensors.
- Correlate port 36422 connection logs against an allowlist of legitimate E2 Node IP addresses.
Monitoring Recommendations
- Enable core dump collection on FlexRIC hosts to capture forensic evidence of crashes.
- Forward syslog and journald entries for the iApp service to a centralized log platform for analysis.
- Track availability metrics for the Near-RT RIC and trigger alerts on subscription drop rates exceeding baseline.
How to Mitigate CVE-2026-37226
Immediate Actions Required
- Restrict network access to TCP port 36422 to known E2 Node IP addresses using host or network firewall rules.
- Deploy FlexRIC inside an isolated O-RAN management network segment, separated from untrusted networks.
- Monitor the iApp service for crashes and configure automatic restart with rate limiting to detect repeated abuse.
Patch Information
No official patch is listed for FlexRIC v2.0.0 at the time of publication. Track the GitLab FlexRIC Project Repository for updates and review the GitHub Security Advisory CVE-2026-37226 for vendor guidance.
Workarounds
- Apply firewall rules permitting only authorized E2 Node source addresses to reach port 36422.
- Run FlexRIC behind a protocol-aware proxy or gateway that validates global_e2_node_id against the active registry before forwarding subscription requests.
- Use a process supervisor such as systemd with Restart=on-failure to recover the iApp service, while logging crash events for investigation.
- Maintain an inventory of authorized E2 Nodes and reject connections from any other source at the network boundary.
# Example iptables rule restricting port 36422 to authorized E2 Nodes
iptables -A INPUT -p tcp --dport 36422 -s 10.10.20.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 36422 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
