CVE-2026-37235 Overview
CVE-2026-37235 affects FlexRIC v2.0.0, an open-source Open RAN Intelligent Controller (RIC) maintained by Mosaic5g. The vulnerability stems from improper access control [CWE-284] in the iApp component, which trusts the xapp_id field carried in E42 message payloads. The validation function valid_xapp_id() confirms only that the identifier falls within an assigned range. It does not bind the identifier to the sender's Stream Control Transmission Protocol (SCTP) association. A remote unauthenticated attacker can impersonate any registered xApp by supplying the target identifier in requests to port 36422.
Critical Impact
Attackers can crash victim xApps, the RIC itself, or the iApp through state inconsistencies introduced into the internal red-black tree data structure, resulting in service-wide denial of service across the RAN control plane.
Affected Products
- Mosaic5g FlexRIC v2.0.0
- FlexRIC iApp listener on port 36422
- Deployments using the E42 messaging interface
Discovery Timeline
- 2026-06-01 - CVE-2026-37235 published to NVD
- 2026-06-03 - Last updated in NVD database
Technical Details for CVE-2026-37235
Vulnerability Analysis
FlexRIC implements the E42 interface to coordinate communication between xApps and iApps over SCTP. When the iApp receives an E42 message, it extracts the xapp_id field from the payload to identify the destination xApp. The function valid_xapp_id() performs only a range check on this field. It never verifies that the SCTP association delivering the message belongs to the xApp that owns the supplied identifier.
Because the identifier is attacker-controlled and unauthenticated, any remote host able to reach port 36422 can claim any active xapp_id. The iApp routes responses, callbacks, and state updates based on this trusted value. Misrouted messages reach an xApp that did not initiate the request, corrupting internal accounting structures.
The iApp tracks subscriptions and pending operations inside a red-black tree keyed on xapp_id. Crafted requests cause inconsistent insertions, deletions, or lookups against this structure, leading to assertion failures and process termination.
Root Cause
The root cause is missing binding between the transport-layer identity (the SCTP association) and the application-layer identifier (xapp_id). The validation logic enforces a syntactic constraint without an authorization check, satisfying [CWE-284] Improper Access Control.
Attack Vector
The attack is network-reachable, requires no authentication, and demands no user interaction. An attacker establishes an SCTP connection to the iApp on port 36422 and sends an E42 message carrying the xapp_id of any legitimate xApp. The iApp forwards crafted responses to the victim xApp, or processes state-changing operations as if the victim issued them. Repeated or malformed requests destabilize the red-black tree and crash one or more components.
No verified proof-of-concept code is published. Refer to the GitHub Security Advisory for CVE-2026-37235 for additional technical detail.
Detection Methods for CVE-2026-37235
Indicators of Compromise
- Unexpected SCTP connections to the iApp listener on port 36422 from hosts outside the documented xApp inventory.
- Repeated E42 messages referencing xapp_id values that do not match the connecting peer's registered association.
- Crash logs or core dumps from FlexRIC iApp or xApp processes referencing red-black tree operations.
Detection Strategies
- Correlate SCTP source addresses with the registered xApp roster and alert on mismatches between xapp_id and association origin.
- Monitor FlexRIC service supervisor logs for abnormal restart loops affecting the iApp or individual xApps.
- Deploy network captures on the E42 interface and inspect for duplicate or impersonated xapp_id values within a short time window.
Monitoring Recommendations
- Forward FlexRIC stdout, stderr, and systemd journal output to a centralized log platform for crash signature analysis.
- Track process uptime and restart counts for iApp and xApp binaries as availability health indicators.
- Baseline normal E42 traffic volume per peer and alert on deviations indicative of impersonation traffic.
How to Mitigate CVE-2026-37235
Immediate Actions Required
- Restrict network access to port 36422 so that only trusted xApp hosts can reach the iApp listener.
- Place FlexRIC components on an isolated management network segment with strict ingress filtering.
- Audit running FlexRIC deployments for version 2.0.0 and prioritize them for remediation.
Patch Information
No fixed version is listed in the NVD record at the time of publication. Monitor the upstream FlexRIC GitLab repository and the advisory entry for CVE-2026-37235 for patch releases. A correct fix must bind each xapp_id to the SCTP association that registered it and reject mismatched messages.
Workarounds
- Enforce firewall rules that allow SCTP connections to port 36422 only from approved xApp source addresses.
- Deploy a reverse proxy or service mesh policy that validates peer identity before forwarding E42 traffic.
- Run iApp and xApps under process supervisors configured to alert operators when crash-restart loops occur.
# Configuration example: restrict E42 iApp port to trusted xApp hosts
iptables -A INPUT -p sctp --dport 36422 -s 10.10.0.0/24 -j ACCEPT
iptables -A INPUT -p sctp --dport 36422 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
