CVE-2026-37234 Overview
CVE-2026-37234 affects FlexRIC v2.0.0, an Open RAN (O-RAN) near-real-time RAN Intelligent Controller (RIC) developed under the Mosaic 5G project. The vulnerability allows a single Stream Control Transmission Protocol (SCTP) connection to bind multiple xapp_id values by sending repeated E42_SETUP_REQUEST messages. When the connection terminates, FlexRIC cleans up only the first registered xapp_id, leaving subsequent registrations and their subscriptions as stale entries in the internal Application (iApp) state. Remote attackers can abuse this flaw to leak subscription state, exhaust resources, and corrupt iApp tracking over time.
Critical Impact
Unauthenticated remote attackers can trigger persistent state leaks in the iApp layer, leading to resource exhaustion and denial of service in the RIC control plane.
Affected Products
- FlexRIC v2.0.0 (Mosaic 5G / EURECOM)
- Deployments using the E42 setup interface with SCTP transport
- O-RAN near-real-time RIC instances exposing xApp registration endpoints
Discovery Timeline
- 2026-06-01 - CVE-2026-37234 published to the National Vulnerability Database
- 2026-06-02 - Last updated in NVD database
Technical Details for CVE-2026-37234
Vulnerability Analysis
FlexRIC implements the E42 interface to register xApps over SCTP. Each E42_SETUP_REQUEST issued by an xApp is supposed to establish a unique association between an xapp_id and an underlying SCTP connection. The flaw in v2.0.0 is that the server accepts multiple E42_SETUP_REQUEST messages on the same SCTP session and registers a new xapp_id for each request without rejecting duplicates or tying all registrations to the connection lifecycle.
The disconnect handler only iterates the cleanup logic for the first xapp_id that bound to the SCTP association. All subsequent xapp_id entries, along with the subscriptions they created, persist in iApp data structures even though the transport channel is gone. This is a resource-management failure mapped to [CWE-400] (Uncontrolled Resource Consumption).
Root Cause
The root cause is incomplete teardown logic in the SCTP disconnect path. FlexRIC does not maintain a one-to-many mapping from SCTP association to all xApp identifiers it has registered. Cleanup operates on a single owner reference, so unreferenced xapp_id records and their RIC subscriptions accumulate as orphaned state.
Attack Vector
An attacker with network reachability to the FlexRIC E42 endpoint opens an SCTP connection and submits multiple E42_SETUP_REQUEST messages with distinct xapp_id values. The attacker then creates RIC subscriptions through each registered identity and closes the connection. The iApp retains the subsequent xapp_id entries and their subscription state indefinitely. Repeating this pattern grows memory and table consumption until the RIC degrades or fails.
No authentication is required, and the attack complexity is low because the E42 protocol exchange is well documented in O-RAN specifications. Exploitation does not require user interaction.
No public proof-of-concept code is available. Refer to the GitHub Security Advisory CVE-2026-37234 and the GitLab Mosaic 5G FlexRIC Project for protocol-level technical details.
Detection Methods for CVE-2026-37234
Indicators of Compromise
- Multiple distinct xapp_id registrations observed over a single SCTP association on the E42 interface.
- Growth in iApp subscription tables that does not correlate with the number of active SCTP connections.
- Repeated E42_SETUP_REQUEST messages from the same source endpoint within short time windows.
- Sustained increase in FlexRIC process memory consumption without a matching increase in legitimate xApp workload.
Detection Strategies
- Instrument the FlexRIC server to log every E42_SETUP_REQUEST with source IP, SCTP association ID, and assigned xapp_id, then alert when more than one xapp_id binds to a single association.
- Track the delta between registered xapp_id count and active SCTP associations; a widening gap indicates stale entries.
- Monitor RIC subscription counts per xApp identity and flag identities with active subscriptions but no live transport.
Monitoring Recommendations
- Forward FlexRIC logs and SCTP connection telemetry to a centralized analytics platform for correlation across nodes.
- Set resource-usage thresholds on the RIC host (memory, file descriptors, subscription tables) and alert on sustained upward trends.
- Capture packet traces on the E42 interface during incident response to confirm repeated setup requests over a single association.
How to Mitigate CVE-2026-37234
Immediate Actions Required
- Restrict network access to the FlexRIC E42 SCTP endpoint to known xApp hosts using firewall rules or network segmentation.
- Audit existing FlexRIC deployments for unexpected xapp_id registrations and restart the RIC to flush stale state if growth is observed.
- Apply rate limiting on inbound SCTP connections and E42_SETUP_REQUEST messages where infrastructure allows.
Patch Information
No official fixed version was listed in the NVD entry at the time of publication. Track upstream commits in the GitLab Mosaic 5G FlexRIC Project and the corresponding GitHub Security Advisory CVE-2026-37234 for remediation guidance. Operators should adopt the fix that enforces a single xapp_id per SCTP association or guarantees cleanup of all registered identifiers when the association closes.
Workarounds
- Place the FlexRIC E42 listener behind a network access control list that only permits trusted xApp endpoints.
- Implement an SCTP-aware proxy or middlebox that drops repeated E42_SETUP_REQUEST messages on an existing association.
- Schedule periodic restarts of the FlexRIC service in lab and pre-production environments where exposure cannot be fully removed.
- Monitor and cap the number of concurrent xApp registrations at the operating system level using cgroups or ulimit controls.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
