CVE-2026-37229: FlexRIC v2.0.0 Remote Denial of Service via Malformed SCTP

Technical summary

CVE-2026-37229 is a reachable assertion failure in the e2ap_create_pdu() function within FlexRIC v2.0.0. When ASN.1 PER (Packed Encoding Rules) decoding encounters invalid input, the function triggers a SIGABRT signal, terminating the process. The flaw affects all three E2AP protocol versions (v1.01, v2.03, v3.01) and occurs at the decode stage, before protocol-level validation gates are applied. An unauthenticated remote attacker can trigger this by sending a single invalid byte (such as 0x00) or any non-PER-compliant byte sequence over SCTP to the listening RIC or iApp ports.

Business impact

Organizations deploying FlexRIC v2.0.0 in production open RAN networks face service interruption risk. The near-RT RIC is typically responsible for real-time radio resource management and slice orchestration. An attacker causing repeated crashes can degrade network availability, impair handover performance, and disrupt network slicing operations. In mission-critical or operator environments, this denial of service could translate to customer-facing service degradation or SLA violations.

Affected systems

FlexRIC v2.0.0 is the confirmed vulnerable version. The vulnerability impacts any deployment listening on SCTP port 36421 (near-RT RIC) or 36422 (iApp). All three supported E2AP protocol versions are affected, so even if an organization has negotiated a specific E2AP version with peer nodes, that deployment remains vulnerable. Verify your FlexRIC version and port configuration against your network topology documentation.

Exploitability

This vulnerability is highly exploitable. No authentication, special privileges, or valid protocol sequence is required—a network-adjacent attacker can send a single malformed packet and cause immediate crash. The CVSS score of 7.5 reflects high availability impact and low attack complexity. The absence of CISA KEV listing does not reduce the practical risk; the attack surface is the public-facing SCTP interface, and tooling to send raw SCTP packets is readily available.

Remediation

Update FlexRIC to a patched version released by mosaic5g. Verify the exact patch version number against the vendor advisory, as updates are version-specific. If an immediate patch is unavailable, implement network-level mitigations: restrict SCTP access to ports 36421 and 36422 via firewall rules, limit to trusted peer nodes (e.g., CU-CP, DU, or other RIC instances), and monitor for abnormal SCTP traffic patterns. Consider deploying the service behind a load balancer that can detect and drop malformed SCTP frames.

Patch guidance

Contact mosaic5g directly or check their advisory documentation for the patched version number and release date. Patching should be coordinated with network operations to minimize service disruption. Test the patch in a non-production environment first, particularly if FlexRIC is serving real traffic. Rolling restart procedures should account for state preservation in the E2 agent layer. Verify that all E2AP versions in use are covered by the patch.

Detection guidance

Monitor SCTP traffic on ports 36421 and 36422 for non-PER-compliant packets or packets of unexpected length. Elevated SIGABRT signals or unexpected process restarts of FlexRIC services are a strong signal of exploitation attempts. Configure alerting on process restart rates for RIC and iApp daemons. Network intrusion detection systems should be tuned to flag malformed SCTP packets destined to these ports. Application-level logging from FlexRIC (if available) may reveal assertion failures prior to crash.

Why prioritize this

Prioritize patching based on your network's role and exposure. If FlexRIC v2.0.0 is deployed in a production near-RT RIC, this is a critical availability risk and should be treated as urgent. If the instance is in a lab or non-critical pilot, priority can be moderate but should still be scheduled soon. The low attack complexity and lack of authentication make this a high-confidence threat—do not defer indefinitely.

Risk score, explained

The CVSS 3.1 score of 7.5 (HIGH) reflects: Network-based attack vector (AV:N), low attack complexity (AC:L), no privileges required (PR:N), no user interaction (UI:N), and high availability impact (A:H). While confidentiality and integrity are unaffected, denial of service in a real-time network controller is operationally severe. The absence of exploit code in the wild and lack of KEV listing do not lower the intrinsic risk; the vulnerability is trivial to weaponize.

Frequently asked questions