CVE-2026-37230: Mosaic5g FlexRIC DoS Vulnerability

CVE-2026-37230 Overview

CVE-2026-37230 is a null pointer dereference vulnerability in FlexRIC v2.0.0, an open-source near Real-Time RAN Intelligent Controller (near-RT RIC) from Mosaic5g. The flaw resides in the handling of RIC_INDICATION messages received on TCP port 36421. When the controller receives an indication carrying a ran_func_id value that is not present in its registry, the function lookup returns NULL, leading to process termination.

A remote, unauthenticated attacker can crash the near-RT RIC by sending a single crafted E2AP message. The defect is tracked under CWE-476: NULL Pointer Dereference.

Critical Impact
Unauthenticated remote attackers can repeatedly crash the near-RT RIC, disrupting Open RAN control-plane operations and any xApps depending on it.

Affected Products

Mosaic5g FlexRIC 2.0.0
Deployments exposing the near-RT RIC E2 termination endpoint on TCP/36421
Debug and Release builds of FlexRIC v2.0.0

Discovery Timeline

2026-06-01 - CVE-2026-37230 published to NVD
2026-06-03 - Last updated in NVD database

Technical Details for CVE-2026-37230

Vulnerability Analysis

FlexRIC implements the O-RAN E2 Application Protocol (E2AP) to broker communication between the near-RT RIC and connected E2 nodes. When an E2 node sends a RIC_INDICATION message, the RIC dispatches it to a registered RAN function identified by ran_func_id. The dispatch routine performs a registry lookup on this identifier before invoking the corresponding handler.

The lookup function returns NULL when the supplied ran_func_id is not registered. FlexRIC dereferences this pointer without first validating the result. In Debug builds, an assert() call detects the invalid state and raises SIGABRT. In Release builds, where assertions are compiled out, the process performs a direct NULL dereference and terminates with SIGSEGV.

Because E2AP communication occurs before any application-layer authentication of the message contents, an attacker with network reachability to TCP/36421 can trigger the crash without credentials or user interaction.

Root Cause

The root cause is missing return-value validation after the RAN function registry lookup. The code path assumes that the function pointer returned for a given ran_func_id is always valid, but the registry does not guarantee this for attacker-supplied identifiers received over the network.

Attack Vector

Exploitation requires only network reachability to the E2 termination port. An attacker establishes an SCTP/TCP connection to port 36421, completes the E2AP setup handshake, and emits a RIC_INDICATION message with an arbitrary ran_func_id not present in the RIC's registry. The receiving process aborts immediately. Repeated connections sustain a denial-of-service condition against the near-RT RIC.

The vulnerability mechanism is described in prose because no verified proof-of-concept code is published. See the GitHub Security Advisory CVE-2026-37230 for the original report and the FlexRIC GitLab repository for source references.

Detection Methods for CVE-2026-37230

Indicators of Compromise

Unexpected SIGABRT or SIGSEGV termination of the FlexRIC nearRT-RIC process, with core dumps referencing the RAN function dispatch path
Repeated short-lived inbound connections to TCP/36421 from unexpected source addresses
E2AP RIC_INDICATION messages carrying ran_func_id values that were never advertised in a prior E2_SETUP_REQUEST

Detection Strategies

Monitor process supervisor logs (systemd, Kubernetes) for restart loops of the near-RT RIC container or service
Inspect E2AP traffic with protocol-aware decoders to flag ran_func_id values not bound to any registered RAN function
Correlate process crashes with inbound E2AP session establishment events on port 36421

Monitoring Recommendations

Forward FlexRIC stderr, core dumps, and process exit codes to a centralized log pipeline for alerting on abnormal termination
Track connection counts and session durations on TCP/36421 to identify probing or flood patterns
Baseline the set of legitimate ran_func_id values per deployment and alert on deviations

How to Mitigate CVE-2026-37230

Immediate Actions Required

Restrict network access to TCP/36421 so that only authorized E2 nodes can reach the near-RT RIC, using firewalls or Kubernetes NetworkPolicies
Place the E2 termination endpoint on an isolated management or fronthaul network segment, not on operator-facing networks
Deploy FlexRIC behind a process supervisor that captures crash diagnostics and rate-limits restarts to surface attacks

Patch Information

No fixed version is identified in the NVD record at the time of publication. Operators should monitor the FlexRIC GitLab repository and the vendor security advisory for an upstream fix and apply it once available. Until then, treat all FlexRIC 2.0.0 instances as exposed.

Workarounds

Enforce mutual authentication and IPsec or DTLS between E2 nodes and the near-RT RIC where the deployment supports it
Apply an allowlist at the network layer permitting only known E2 node IP addresses to reach port 36421
Run FlexRIC in Release mode behind an automated restart policy to reduce downtime, while recognizing this does not prevent the crash itself

bash

# Example iptables allowlist for the E2 termination port
iptables -A INPUT -p tcp --dport 36421 -s 10.10.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 36421 -j DROP