CVE-2026-37228: Mosaic5g FlexRIC DoS Vulnerability

CVE-2026-37228 Overview

CVE-2026-37228 is a reachable assertion vulnerability in Mosaic5g FlexRIC v2.0.0, an open-source near Real-Time RAN Intelligent Controller (near-RT RIC) for O-RAN deployments. The flaw resides in the e2ap_recv_sctp_msg() function within src/lib/ep/e2ap_ep.c. A remote unauthenticated attacker can send a single oversized SCTP message to crash the target process via SIGABRT. The vulnerability affects all four SCTP endpoint types listening on ports 36421 and 36422, including the near-RT RIC, iApp, E2 Agent, and xApp processes. No valid E2AP Protocol Data Unit (PDU) is required to trigger the condition.

Critical Impact
A single unauthenticated SCTP packet exceeding 32,768 bytes crashes core O-RAN control plane components, enabling denial of service against the entire RAN Intelligent Controller fabric.

Affected Products

Mosaic5g FlexRIC v2.0.0
FlexRIC near-RT RIC, iApp, E2 Agent, and xApp SCTP endpoints (ports 36421 and 36422)
Release builds with NDEBUG defined, where the stripped assertion produces additional memory safety issues

Discovery Timeline

2026-06-01 - CVE-2026-37228 published to the National Vulnerability Database (NVD)
2026-06-03 - Last updated in NVD database

Technical Details for CVE-2026-37228

Vulnerability Analysis

The vulnerability is classified as a reachable assertion [CWE-617] in the E2AP SCTP message receive path. FlexRIC allocates a fixed 32 KB receive buffer and invokes sctp_recvmsg() to read inbound data. The code then enforces assert(rc < len) against the return value, where len equals 32,768 bytes. When sctp_recvmsg() returns a value equal to or greater than the buffer length, the assertion fires and the process terminates via SIGABRT.

Because the assertion executes before any E2AP protocol parsing or authentication, attackers do not need to craft a valid E2AP PDU. The shared code path is reused across the near-RT RIC, iApp, E2 Agent, and xApp components, so a single payload pattern affects all SCTP endpoints exposed by FlexRIC.

In Release builds compiled with NDEBUG, the assertion is stripped from the binary. The unchecked return value then participates in a signed-to-unsigned integer conversion, producing an integer overflow and a potential out-of-bounds read during subsequent buffer processing.

Root Cause

The root cause is improper validation of the sctp_recvmsg() return value combined with a fixed-size receive buffer. The developer relied on assert() as a runtime safety check rather than implementing structured error handling. SCTP message framing permits payloads larger than the chosen buffer, so the assumption that rc < len is always true does not hold against untrusted peers.

Attack Vector

An attacker reachable over the network establishes an SCTP association to TCP/SCTP port 36421 or 36422 on a FlexRIC endpoint. The attacker then transmits a single SCTP DATA chunk whose payload size is at least 32,768 bytes. The receiving process aborts immediately, dropping all E2 connections managed by that endpoint. Repeated transmissions prevent service recovery after restart, sustaining denial of service against the O-RAN control plane. Detailed technical context is available in the GitHub Security Advisory CVE-2026-37228.

Detection Methods for CVE-2026-37228

Indicators of Compromise

Unexpected SIGABRT termination of FlexRIC processes (near-RT RIC, iApp, E2 Agent, xApp) with stack frames referencing e2ap_recv_sctp_msg in e2ap_ep.c.
Inbound SCTP packets to ports 36421 or 36422 with DATA chunk payloads of 32,768 bytes or larger from unexpected source addresses.
Repeated SCTP INIT or ABORT sequences correlated with FlexRIC service restarts in systemd or container orchestration logs.

Detection Strategies

Inspect FlexRIC core dumps and crash logs for assertion failure messages tied to the assert(rc < len) expression in e2ap_ep.c.
Deploy SCTP-aware network sensors that flag DATA chunks exceeding 32 KB destined for E2AP endpoints.
Correlate process termination events with concurrent SCTP traffic to identify deliberate crash attempts versus benign failures.

Monitoring Recommendations

Monitor SCTP association establishment and teardown rates on ports 36421 and 36422 for anomalous spikes.
Track FlexRIC service uptime and restart counts as a leading indicator of repeated exploitation attempts.
Forward FlexRIC stdout, stderr, and systemd journal entries to a centralized logging tier for crash signature analysis.

How to Mitigate CVE-2026-37228

Immediate Actions Required

Restrict network reachability of SCTP ports 36421 and 36422 to known E2 nodes through firewall or network policy enforcement.
Place FlexRIC components behind segmented management networks and disallow internet exposure of E2AP endpoints.
Audit deployments to confirm whether builds were compiled with NDEBUG, which converts the crash into a potential out-of-bounds read.

Patch Information

No official patch identifier is referenced in the NVD entry for CVE-2026-37228 at the time of publication. Track the upstream project at the GitLab FLEXRIC Project Repository and the GitHub Security Advisory CVE-2026-37228 for fix availability. A correct remediation must validate the sctp_recvmsg() return value, reject oversized messages, and replace the assert() with structured error handling.

Workarounds

Apply strict access control lists (ACLs) on SCTP ports 36421 and 36422 to permit only authenticated E2 nodes and xApps.
Deploy an SCTP-aware proxy or middlebox that enforces a maximum message size below 32,768 bytes before traffic reaches FlexRIC.
Run FlexRIC under a process supervisor configured to rate-limit restarts so repeated crashes do not mask broader incidents.
Avoid Release builds with NDEBUG until the input validation fix lands, since stripped assertions expose additional memory safety risk.

bash

# Example nftables rule restricting SCTP E2AP ports to a trusted subnet
nft add table inet flexric_filter
nft add chain inet flexric_filter input { type filter hook input priority 0 \; policy drop \; }
nft add rule inet flexric_filter input ip saddr 10.10.0.0/24 sctp dport { 36421, 36422 } accept
nft add rule inet flexric_filter input sctp dport { 36421, 36422 } drop