CVE-2026-37231 Overview
CVE-2026-37231 affects FlexRIC v2.0.0, an Open Radio Access Network (O-RAN) RAN Intelligent Controller developed by Mosaic5g. The vulnerability exists in the xApp registration handling on the iApp service listening on port 36422. FlexRIC assigns xapp_id values using a uint16_t counter but stores the result in uint32_t message fields. After approximately 65,530 E42_SETUP_REQUEST messages, the counter wraps around and produces duplicate identifiers. The iApp crashes when it attempts to insert a duplicate ID into its internal data structure. The flaw maps to [CWE-191: Integer Underflow (Wrap or Wraparound)].
Critical Impact
A remote, unauthenticated attacker can crash the iApp service by repeatedly issuing xApp setup requests until the 16-bit counter wraps, producing a denial-of-service condition on the RIC control plane.
Affected Products
- Mosaic5g FlexRIC 2.0.0
- FlexRIC iApp service listening on TCP port 36422
- O-RAN Near-RT RIC deployments built on the FlexRIC codebase
Discovery Timeline
- 2026-06-01 - CVE-2026-37231 published to NVD
- 2026-06-03 - Last updated in NVD database
Technical Details for CVE-2026-37231
Vulnerability Analysis
FlexRIC implements the E42 interface to register external xApps with the RIC. When an xApp issues an E42_SETUP_REQUEST, the iApp allocates a new xapp_id from an internal counter. The counter is declared as uint16_t, limiting the value space to 65,536 unique IDs. The assigned value is then written into message fields typed as uint32_t, which masks the size mismatch at the type-system level. Once the counter exceeds 0xFFFF, it wraps to zero and begins reissuing identifiers already present in the registration table. The crash occurs when the data structure backing the xApp registry rejects or mishandles the duplicate key, terminating the iApp process.
Root Cause
The root cause is an integer type mismatch between the counter generating xapp_id values and the message fields transporting them. The narrower uint16_t counter wraps long before the uint32_t field exhausts its range. No validation rejects duplicate IDs before they reach the registry insertion logic, so the wrap is converted directly into a fatal condition.
Attack Vector
An attacker reachable on the network path to port 36422 repeatedly opens connections and sends valid E42_SETUP_REQUEST messages. No authentication is required. After roughly 65,530 successful registrations, the next request triggers a duplicate xapp_id and crashes the iApp. The result is a denial of service against the RIC, disabling xApp-driven RAN control logic until the service is restarted.
No verified proof-of-concept code is published. The vulnerability mechanism is described in the GitHub Security Advisory CVE-2026-37231.
Detection Methods for CVE-2026-37231
Indicators of Compromise
- High volume of inbound TCP connections to the FlexRIC iApp port 36422 from a single source or small set of sources.
- Repeated E42_SETUP_REQUEST messages without corresponding xApp teardown traffic.
- Sudden termination of the iApp process and loss of xApp control-plane functionality.
Detection Strategies
- Monitor connection rates and request counts against the iApp endpoint and alert on sustained registration traffic exceeding normal xApp lifecycle activity.
- Track the internal xapp_id allocation counter, if exposed through logs or telemetry, and flag values approaching the uint16_t ceiling.
- Correlate iApp process restarts with preceding spikes in E42 traffic to identify exploitation attempts.
Monitoring Recommendations
- Forward iApp service logs and network telemetry to a centralized analytics platform for rate-based anomaly detection.
- Configure alerts on FlexRIC process crashes and unexpected restarts of the RIC control plane.
- Capture packet metadata for port 36422 to support post-incident review of registration floods.
How to Mitigate CVE-2026-37231
Immediate Actions Required
- Restrict network reachability to TCP port 36422 so that only trusted xApp hosts can initiate E42 setup requests.
- Place the FlexRIC iApp behind a firewall or service mesh policy that enforces source IP allowlisting and per-source rate limits.
- Monitor the FlexRIC project repository at GitLab FlexRIC for an official fix and apply it once available.
Patch Information
No vendor patch is referenced in the NVD entry at the time of publication. Track the GitHub Security Advisory CVE-2026-37231 and the upstream FlexRIC repository for remediation commits that widen the counter to uint32_t, add duplicate-ID checks, or recycle freed identifiers.
Workarounds
- Periodically restart the iApp service during maintenance windows to reset the counter before it approaches the uint16_t boundary.
- Deploy network ACLs that limit E42_SETUP_REQUEST rates from any single peer.
- Run FlexRIC inside an isolated management network segment, blocking all external access to the iApp port.
# Example iptables rules restricting access to the FlexRIC iApp port
iptables -A INPUT -p tcp --dport 36422 -s 10.0.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 36422 -m conntrack --ctstate NEW -m limit --limit 10/minute -j ACCEPT
iptables -A INPUT -p tcp --dport 36422 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
