CVE-2026-37223: FlexRIC E2AP Dispatcher Assertion DoS – High-Severity O-RAN Vulnerability

Technical summary

CVE-2026-37223 is a reachable assertion vulnerability (CWE-617) in the E2AP message dispatcher of FlexRIC v2.0.0. The dispatcher validates incoming Protocol Data Units (PDUs) against a hardcoded 9-entry whitelist using assert() statements. When an unauthenticated remote attacker sends any decodable E2AP PDU with a message_type field not present in the whitelist, the assertion fails, triggering SIGABRT and terminating the dispatcher process. Since iApp and the near-RT RIC share a single process space, this crash propagates to the RIC service layer, forcing disconnection of all attached E2 Nodes and xApps and disrupting O-RAN operations.

Business impact

RIC service outages disrupt O-RAN deployments and affect network operations at scale. A single remote packet can force complete service restart, losing transient state and causing E2 node reconnection storms. For operators relying on xApps for dynamic resource allocation, coverage optimization, or network slicing, this becomes a single-point-of-failure vector. Recovery requires manual process restart and E2 node re-registration, introducing operational overhead and potential SLA violations.

Affected systems

FlexRIC v2.0.0 is affected. Verify with the vendor whether later versions or patches have been released. FlexRIC is an open-source near-real-time RAN Intelligent Controller used in O-RAN deployments.

Exploitability

Exploitability is high. The attack requires network reachability to port 36422 (iApp), no authentication, and only the ability to send a valid but unlisted E2AP message. Any host with network path to the RIC can trigger the crash. The barrier to exploitation is minimal: constructing a well-formed E2AP PDU with an out-of-whitelist message type. No special tools or sophisticated techniques are required.

Remediation

Update FlexRIC to a patched version that replaces assertion-based validation with exception handling or logging that allows the dispatcher to safely reject invalid message types without crashing. Contact the FlexRIC project maintainers for available patches. Until patching is possible, implement network segmentation to restrict access to port 36422 to trusted RIC management and E2 node subnets only.

Patch guidance

Check the FlexRIC project repository and vendor advisory for available patches addressing CWE-617 in the E2AP dispatcher. Patches should replace assert() calls with proper error handling that logs the rejection and continues operation. Apply patches to all near-RT RIC instances in your deployment. Verify patch completeness by confirming the whitelist validation logic no longer uses assertions. Test patched systems in a non-production environment before production rollout.

Detection guidance

Monitor RIC process crashes and SIGABRT signals targeting port 36422. Log E2AP message validation failures and rejected message types. Implement network IDS/IPS signatures to detect decodable E2AP messages with unexpected message_type values sent to the RIC. Correlate sudden RIC service restarts with E2 node disconnection events. Baseline normal E2AP traffic patterns and alert on anomalies that precede RIC outages.

Why prioritize this

HIGH severity (CVSS 7.5) combined with zero authentication requirement, network accessibility, and immediate impact on critical RAN infrastructure makes this a priority-1 remediation target. RIC availability is fundamental to O-RAN operations; a trivial remote crash vector poses unacceptable operational risk.

Risk score, explained

CVSS 3.1 score of 7.5 reflects high network attack vector (AV:N), low complexity (AC:L), no privilege requirement (PR:N), no user interaction (UI:N), and high availability impact (A:H). The scope is unchanged (S:U) and there is no confidentiality or integrity impact. The score appropriately captures the ease of exploitation and severity of denial-of-service consequence, but does not account for widespread O-RAN adoption or potential for coordinated attacks across multiple RIC instances.

Frequently asked questions