What is the CVSS score of CVE-2026-37222?

CVE-2026-37222 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.1%.

Which versions of FlexRIC are affected by CVE-2026-37222?

FlexRIC v2.0.0, a near-real-time RAN Intelligent Controller used in 5G research and testbed deployments, is vulnerable to remote denial-of-service attacks that can crash critical RIC services via…

How to fix or mitigate CVE-2026-37222?

Within 24 hours: Inventory all FlexRIC v2.0.0 instances, confirm vulnerable versions, and restrict network access to ports 36421 (near-RT RIC) and 36422 (iApp) to authorized management networks only. Within 7 days: Enable continuous monitoring for vendor security advisories and patch availability; establish contact with FlexRIC/O-RAN project maintainers for remediation timelines. Within 30 days: Execute upgrade to patched FlexRIC version upon release, or transition to alternative RAN Intelligent Controller solution if patch timeline is uncertain.

FlexRIC CVE-2026-37222

EUVD-2026-33696 HIGH

Reachable Assertion (CWE-617)

2026-06-01 mitre

GHSA-mw4p-gj5j-3xhr

Denial Of Service N A

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 01, 2026 - 19:27 vuln.today

CVSS changed

Jun 01, 2026 - 19:22 NVD

7.5 (HIGH)

CVE Published

Jun 01, 2026 - 00:00 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

FlexRIC v2.0.0 uses hardcoded assertions to validate Information Element (IE) counts in decoded E2AP messages. A remote unauthenticated attacker can send a valid E2AP PDU containing an unexpected number of IEs (e.g., an E2setupRequest with extra optional fields) to crash the near-RT RIC (port 36421) or iApp (port 36422) via SIGABRT. The code asserts exact IE counts rather than validating against protocol-specified ranges.

AnalysisAI

Remote denial of service in FlexRIC v2.0.0 allows unauthenticated attackers to crash the near-RT RIC (port 36421) or iApp (port 36422) by sending a valid E2AP PDU containing an unexpected number of Information Elements, triggering a SIGABRT via overly strict hardcoded assertions. The flaw affects open-source O-RAN near-real-time RAN Intelligent Controller deployments used in 5G research and testbeds, and no public exploit has been identified at time of analysis. The CVSS 7.5 reflects high availability impact with no confidentiality or integrity loss.

Technical ContextAI

FlexRIC is the EURECOM/Mosaic5G open-source implementation of the O-RAN near-real-time RIC and is built around the E2 Application Protocol (E2AP), an ASN.1-encoded signaling protocol that carries Information Elements (IEs) between the RIC and connected E2 nodes (gNBs/eNBs). The CWE-617 (Reachable Assertion) root cause is that FlexRIC's E2AP decoder enforces IE counts using hardcoded assert() statements that demand an exact number of IEs, rather than validating against the optional/mandatory ranges defined by the O-RAN E2AP specification. When an assertion fails in a release build that still has assertions compiled in, libc raises SIGABRT and terminates the process, taking down the RIC daemon listening on TCP/SCTP 36421 and the iApp interface on 36422.

RemediationAI

No vendor-released patch identified at time of analysis; monitor the upstream FlexRIC repository at https://gitlab.eurecom.fr/mosaic5g/flexric and the advisory at https://github.com/MinamiKotor1/oran-security-advisories-zhongnan-luo/blob/main/advisories/CVE-2026-37222.md for a fixed release or commit. Until a fix is published, the most effective compensating control is network segmentation: restrict TCP/SCTP access to ports 36421 (near-RT RIC E2 termination) and 36422 (iApp) to only the IP addresses of authorized E2 nodes via host firewall (iptables/nftables) or perimeter ACLs - the trade-off is operational, since any legitimate E2 node added later must be allowlisted. Operators building FlexRIC from source can mitigate by rebuilding with -DNDEBUG to compile out assert() macros, which prevents the SIGABRT but leaves the underlying malformed-IE handling undefined and may mask other bugs, so it should be treated as a stopgap rather than a fix. Adding a watchdog/systemd Restart=always policy will reduce downtime per crash but does not prevent re-exploitation.