CVE-2026-37231: FlexRIC xapp_id Counter Overflow Denial of Service

Technical summary

The vulnerability stems from a type mismatch in xapp_id handling. FlexRIC uses a uint16_t counter to generate xapp_id values, but stores these identifiers in uint32_t message fields. This design allows the counter to wrap around at 65,536 (2^16), causing xapp_id reuse. The iApp process, which maintains an internal registry of active xApp instances indexed by xapp_id, lacks duplicate-key protection. When a second registration attempt arrives with an xapp_id that matches an existing entry, the data structure fails catastrophically rather than rejecting the duplicate or handling the collision gracefully. This is a classic integer overflow condition (CWE-191) applied to an identifier namespace.

Business impact

Denial of service against the RIC (RAN Intelligent Controller) infrastructure. The iApp crash disrupts xApp (intelligent application) lifecycle management, preventing new applications from registering and potentially blocking the entire network intelligence stack. In production Open RAN deployments, this translates to loss of automated radio access network optimization, reduced visibility into network behavior, and potential cascade failures if dependent services assume continuous iApp availability. Recovery requires manual intervention to restart the iApp process, introducing operational latency.

Affected systems

Mosaic5G FlexRIC v2.0.0 is explicitly vulnerable. Organizations running this version with exposed E42 protocol interfaces should assume compromise potential. The vulnerability requires network-level access to port 36422 (iApp) or the E42 protocol endpoint, so internal deployments have reduced exposure compared to publicly routed RIC infrastructure. Verify whether your deployment runs v2.0.0 specifically and assess your network segmentation around RIC components.

Exploitability

Exploitability is high. No authentication or privilege escalation is required—any attacker with network connectivity to the E42 interface can craft and send E42_SETUP_REQUEST messages. The attack is deterministic and does not depend on timing, race conditions, or user interaction. However, exploitation requires sustained traffic (65,530+ requests) to trigger the counter overflow, making it detectable if monitoring for abnormal registration patterns. The attack is not known to be weaponized in public exploits at this time.

Remediation

Upgrade FlexRIC to a patched version that corrects the xapp_id counter type or implements duplicate-key detection in the iApp registry. Pending vendor patches, implement network-level access controls to restrict E42 protocol traffic to trusted sources and apply rate limiting on E42_SETUP_REQUEST messages to slow counter wraparound and provide time for detection and intervention. Monitor iApp process stability and restart failures as leading indicators of exploitation attempts.

Patch guidance

Contact Mosaic5G or consult the official FlexRIC security advisory for patched version availability and deployment procedures. Patches should address either the fundamental type mismatch (promoting the counter to uint32_t) or adding idempotency and collision handling in the xApp registry. When a patch is released, validate it in a non-production environment before rolling out to production RIC infrastructure. Document the pre-patch and post-patch xapp_id behavior to ensure the fix does not introduce state management side effects.

Detection guidance

Monitor the iApp process (typically listening on port 36422) for unexpected restart events or crashes. Enable debug logging for E42_SETUP_REQUEST message handling to identify rapid, repetitive registration attempts from a single source IP. Network-based detection can flag abnormally high volumes of E42_SETUP_REQUEST traffic over short time windows. Correlate iApp crashes with corresponding E42 traffic spikes to confirm exploitation. Alert on any xapp_id collision or duplicate-key error messages in RIC logs.

Why prioritize this

This vulnerability merits immediate attention due to its HIGH CVSS score (7.5), zero authentication requirement, and direct impact on critical RAN intelligence infrastructure. Although it requires sustained traffic to trigger, the deterministic nature and lack of weaponization complexity make it a strong candidate for rapid exploitation once publicly disclosed. Open RAN deployments are increasingly common in production networks, making FlexRIC availability a legitimate operational concern.

Risk score, explained

CVSS 3.1 score of 7.5 (HIGH) reflects: network-accessible attack vector (AV:N), no special conditions needed (AC:L), no authentication required (PR:N), no user interaction (UI:N), and impact isolated to availability (A:H) with no confidentiality or integrity loss. The score appropriately captures the denial-of-service severity while acknowledging that exploitation requires network access and sustained attack effort. Organizations should treat HIGH severity vulnerabilities as candidates for urgent patching cycles, typically 14–30 days depending on asset criticality.

Frequently asked questions