CVE-2026-37229: Mosaic5g Flexric DoS Vulnerability

CVE-2026-37229 Overview

CVE-2026-37229 is a reachable assertion vulnerability in Mosaic5g FlexRIC v2.0.0, an open-source Open RAN (O-RAN) near-real-time RAN Intelligent Controller (near-RT RIC) implementation. The flaw exists in the e2ap_create_pdu() function, which fails to gracefully handle malformed ASN.1 Packed Encoding Rules (PER) input. A remote unauthenticated attacker can deliver a single non-PER byte over Stream Control Transmission Protocol (SCTP) to crash the process via SIGABRT. The condition is triggered before any protocol-level validation occurs, affecting all three E2AP protocol versions: v1.01, v2.03, and v3.01.

Critical Impact
A single 0x00 byte sent to TCP/SCTP port 36421 (near-RT RIC) or port 36422 (iApp) terminates the FlexRIC process, disrupting RAN control plane operations across O-RAN deployments.

Affected Products

Mosaic5g FlexRIC version 2.0.0
E2AP protocol versions v1.01, v2.03, v3.01
Near-RT RIC SCTP listener (port 36421) and iApp listener (port 36422)

Discovery Timeline

2026-06-01 - CVE-2026-37229 published to NVD
2026-06-03 - Last updated in NVD database

Technical Details for CVE-2026-37229

Vulnerability Analysis

The vulnerability is classified as a reachable assertion [CWE-617] within the E2 Application Protocol (E2AP) message parsing layer. FlexRIC implements the O-RAN E2 interface using ASN.1 PER encoding to serialize Protocol Data Units (PDUs) exchanged between the near-RT RIC and connected E2 nodes. When the e2ap_create_pdu() function attempts to decode incoming bytes, a failed PER decode triggers an assert() rather than returning an error to the caller.

Because assertion failures call abort() and raise SIGABRT, the FlexRIC process terminates immediately. The decoding path executes before any session establishment, protocol handshake, or message-type validation. An attacker therefore needs no credentials, no prior connection state, and no knowledge of E2AP semantics.

All three protocol revisions supported by FlexRIC share this code path, meaning the issue cannot be avoided by selecting a different E2AP version at build time.

Root Cause

The root cause is the use of assert() for runtime input validation. Assertions are intended to catch programmer errors during development, not to enforce trust boundaries between a network listener and untrusted peers. Treating decode failure as an unrecoverable condition transforms any malformed input into a denial-of-service primitive.

Attack Vector

An attacker with network reachability to the near-RT RIC sends arbitrary bytes over SCTP to port 36421 or 36422. A single 0x00 byte is sufficient to fail PER decoding and trigger the assertion. The attack requires no authentication and no user interaction, and it can be repeated to keep the service offline. See the GitHub Security Advisory CVE-2026-37229 for the full technical write-up.

Detection Methods for CVE-2026-37229

Indicators of Compromise

Unexpected SIGABRT termination of the FlexRIC nearRT-RIC process with stack frames referencing e2ap_create_pdu().
Core dump files generated on the RIC host correlating with inbound SCTP connections on port 36421 or 36422.
Repeated short-lived SCTP associations from non-allowlisted peers immediately followed by process restart events.

Detection Strategies

Monitor process supervisors (systemd, Kubernetes, custom orchestrators) for repeated restart loops of FlexRIC components.
Inspect SCTP flow records for malformed E2AP traffic patterns, particularly tiny payloads followed by association teardown.
Correlate RIC service outages with network telemetry to identify the originating E2 node or external host.

Monitoring Recommendations

Enable verbose logging on E2AP message ingress and ship logs to a centralized analytics platform for anomaly identification.
Alert on any SCTP traffic to ports 36421 and 36422 originating outside the expected O-RAN fronthaul or management network.
Track availability metrics for the near-RT RIC and iApp endpoints to detect the denial-of-service condition early.

How to Mitigate CVE-2026-37229

Immediate Actions Required

Restrict SCTP access to ports 36421 and 36422 to known E2 nodes using firewall or network policy rules.
Place FlexRIC behind a segmented O-RAN management VLAN with no exposure to untrusted networks.
Enable automatic process restart with rate limiting to slow repeated crash-loop exploitation while a permanent fix is applied.

Patch Information

At the time of publication, no fixed release is referenced in the NVD entry. Operators should track the upstream GitLab FlexRIC Project Repository and the GitHub Security Advisory CVE-2026-37229 for patch availability. A proper fix replaces the assert() in e2ap_create_pdu() with structured error handling that logs the malformed PDU and closes the offending SCTP association.

Workarounds

Apply strict SCTP peer allowlists at the host firewall (for example, nftables or iptables with the sctp match) to block untrusted sources.
Deploy an E2AP-aware proxy or filter in front of FlexRIC that validates PER framing before forwarding traffic.
Run FlexRIC under a watchdog that imposes restart backoff to limit the impact of repeated crash attempts.

bash

# Configuration example: restrict SCTP access to known E2 nodes
nft add table inet oran_filter
nft add chain inet oran_filter input { type filter hook input priority 0 \; policy drop \; }
nft add rule inet oran_filter input ip saddr { 10.10.0.0/24 } sctp dport { 36421, 36422 } accept
nft add rule inet oran_filter input sctp dport { 36421, 36422 } drop