CVE-2026-37221: FlexRIC v2.0.0 Unauthenticated Denial-of-Service via RIC Message Crash

Technical summary

CVE-2026-37221 stems from improper error handling in FlexRIC's RIC_SUBSCRIPTION_RESPONSE message processor. The near-RT RIC expects every response message to correspond to a pending subscription event tracked in local state. When a response arrives with an unknown ric_id, the code invokes assert() to enforce the invariant that a matching pending event must exist. In Debug builds, this assertion failure raises SIGABRT. In Release builds where assertions are often disabled, the subsequent code attempts to dereference a NULL pointer, resulting in SIGSEGV. The vulnerability is classified as CWE-617 (Assertion Failure) and can be triggered by any remote actor with network access to port 36421.

Business impact

This vulnerability enables attackers to remotely disable near-RT RIC services without authentication, disrupting RAN (Radio Access Network) orchestration and automation. In environments where near-RT RIC is a critical component of network management, repeated crashes or sustained crashes could degrade service availability, impact call setup delays, or prevent real-time optimization of network resources. Recovery requires manual restart and may cause transient loss of dynamic RAN adjustments. Organizations relying on FlexRIC for near-real-time network control should prioritize mitigation.

Affected systems

FlexRIC v2.0.0 is affected. The vulnerability resides in the near-RT RIC listener on port 36421, which processes inbound RIC_SUBSCRIPTION_RESPONSE messages. Any deployment of FlexRIC v2.0.0 that exposes this port to untrusted networks is susceptible. The vendor has not provided information on whether earlier or later versions are affected; verify against the official vendor advisory.

Exploitability

Exploitability is high. The attack requires only network reachability to port 36421 and no authentication credentials. Crafting a malformed RIC_SUBSCRIPTION_RESPONSE message is straightforward for an attacker with knowledge of the RIC protocol format. The vulnerability is trivial to trigger repeatedly, making it suitable for DoS attacks. No user interaction is needed. However, active exploitation in the wild has not been confirmed (KEV status is not active).

Remediation

Upgrade FlexRIC to a patched version once the vendor releases one. In the interim, implement network-level controls: restrict access to port 36421 using firewall rules, allow only trusted RIC controllers to communicate with the near-RT RIC, and monitor for unexpected RIC_SUBSCRIPTION_RESPONSE messages from unknown sources. Consider isolating near-RT RIC services to a protected management network and implement rate limiting on subscription response handling. Consult the vendor advisory for the specific patched version and validation steps.

Patch guidance

Monitor the vendor's advisory channels for a security patch. Apply the patch during a maintenance window after validating it in a test environment. The patch should replace the assert()-based validation with proper error handling that returns an error code or discards the malformed message without crashing the process. Before patching production systems, verify that the patched version does not introduce regressions in subscription handling or performance. Rollback procedures should be documented.

Detection guidance

Monitor near-RT RIC process logs for unexpected SIGABRT or SIGSEGV signals on port 36421. Implement alerts for rapid service restarts or repeated crashes of the FlexRIC process. Network-level detection: capture and inspect RIC_SUBSCRIPTION_RESPONSE packets for responses with ric_ids that do not correspond to known pending subscriptions. Correlate RIC message logs with system crash logs to identify attack patterns. Set up anomaly detection for port 36421 traffic originating from unexpected IP ranges.

Why prioritize this

This vulnerability merits urgent attention due to its high CVSS score (7.5), unauthenticated attack vector, low complexity, and direct impact on service availability. While not yet actively exploited in the wild (KEV status is inactive), the ease of exploitation and the criticality of near-RT RIC in modern RAN architectures make it a priority for patching. Organizations should treat this as a high-priority item for network segment access control and patch deployment planning.

Risk score, explained

The CVSS v3.1 score of 7.5 (HIGH) reflects an unauthenticated, low-complexity, network-based denial-of-service attack with no user interaction required. The attack vector is Network (AV:N), access complexity is Low (AC:L), privileges are None (PR:N), and user interaction is None (UI:N). The scope is Unchanged (S:U), and availability impact is High (A:H). Confidentiality and integrity are unaffected. The score appropriately captures the severity of a remotely triggerable crash but does not account for exploits already in active use (KEV status suggests this is still emerging).

Frequently asked questions