What is the CVSS score of CVE-2026-37220?

CVE-2026-37220 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.1%.

Which versions of FlexRIC are affected by CVE-2026-37220?

FlexRIC v2.0.0 near-RT RIC contains an unauthenticated remote denial-of-service vulnerability that allows attackers to crash the RAN controller (port 36421) with a trivial network connection, with no…

How to fix or mitigate CVE-2026-37220?

Within 24 hours: Immediately inventory all FlexRIC v2.0.0 instances; implement network segmentation to restrict SCTP access to port 36421 from trusted sources only; validate out-of-band failover capability. Within 7 days: Deploy IDS/IPS signatures to detect and block incomplete SCTP handshakes without E2AP messages; configure alerting on controller restart events; confirm no active exploitation in logs (search for unexpected SCTP connections and abrupt controller terminations). Within 30 days: Contact FlexRIC vendor for patch timeline and version upgrade options; if unavailable, design architectural redundancy (active-active or active-passive controllers) to minimize DoS impact; evaluate alternative RIC implementations for future deployments.

FlexRIC CVE-2026-37220

EUVD-2026-33659 HIGH

Reachable Assertion (CWE-617)

2026-06-01 cve@mitre.org

GHSA-wgcx-v4x6-3pp9

Denial Of Service

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 01, 2026 - 17:30 vuln.today

CVSS changed

Jun 01, 2026 - 17:22 NVD

7.5 (HIGH)

CVE Published

Jun 01, 2026 - 15:16 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

FlexRIC v2.0.0 crashes when an SCTP association is closed before an E2_SETUP_REQUEST is sent. The near-RT RIC assumes a mapping between SCTP association and E2 node always exists in the cleanup path and enforces this via assert(). A remote unauthenticated attacker can crash the near-RT RIC (port 36421) by simply completing an SCTP handshake and immediately disconnecting, without sending any E2AP message.

AnalysisAI

Remote denial-of-service in FlexRIC v2.0.0 near-RT RIC allows unauthenticated attackers to crash the controller (port 36421) by completing an SCTP handshake and immediately disconnecting without sending any E2AP message. The cleanup path triggers a reachable assert() because the code assumes an SCTP-association-to-E2-node mapping always exists. No public exploit identified at time of analysis, but the trigger is trivial and the CVSS vector (AV:N/AC:L/PR:N/UI:N, A:H) reflects a low-effort network attack with high availability impact.

Technical ContextAI

FlexRIC is the EURECOM/Mosaic5G open-source implementation of the O-RAN near-Real-Time RAN Intelligent Controller (near-RT RIC), which terminates the E2 interface that connects to E2 nodes (gNBs, eNBs, O-CUs/O-DUs) over SCTP, typically on port 36421. The E2AP setup procedure begins with an E2_SETUP_REQUEST sent over an established SCTP association. The root cause is CWE-617 (Reachable Assertion): the cleanup handler on SCTP teardown invokes assert() to validate an internal mapping between the SCTP association and an E2 node, but that mapping is only populated after an E2_SETUP_REQUEST is processed. When the peer disconnects after the SCTP four-way handshake but before any E2AP message is exchanged, the assertion fires and aborts the process. Affected upstream is hosted at gitlab.eurecom.fr/mosaic5g/flexric.

RemediationAI

No vendor-released patch identified at time of analysis; the NVD entry references the upstream Mosaic5G FlexRIC GitLab repository and a third-party advisory at https://github.com/MinamiKotor1/oran-security-advisories-zhongnan-luo/blob/main/advisories/CVE-2026-37220.md but no fixed version is cited in the provided inputs - monitor the upstream repo for a release that replaces the assert() with a defensive null check on the SCTP-to-E2-node mapping. As compensating controls, restrict SCTP reachability on port 36421 to known E2 node IPs via host or network ACLs (trade-off: requires maintaining an allowlist as E2 nodes are added or relocated), terminate the E2 plane on a dedicated isolated VLAN/VRF separated from management and external networks (trade-off: requires deployment-time network design), and consider supervising the RIC process with an auto-restart unit such as systemd Restart=always (trade-off: restores availability after a crash but does not prevent repeated DoS, and may mask the attack from operators unless paired with crash-loop alerting).