What is the CVSS score of CVE-2026-37224?

CVE-2026-37224 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.1%.

Which versions of FlexRIC are affected by CVE-2026-37224?

FlexRIC v2.0.0, the open-source RAN Intelligent Controller used in 5G/6G network deployments, is vulnerable to unauthenticated remote denial-of-service attacks that crash the iApp process with…

How to fix or mitigate CVE-2026-37224?

Within 24 hours: Identify all FlexRIC v2.0.0 deployments and restrict network access to TCP/36421 to authorized E2 nodes only. Within 7 days: Deploy network-layer rate limiting on E2_SETUP_REQUEST messages; implement duplicate E2 node configuration detection and rejection; enable forensic logging of all setup requests. Within 30 days: Contact Eurecom Mosaic5G project to confirm patch development status and timeline; evaluate upgrade to patched versions or alternative RIC implementations; document incident response procedures specific to RIC availability incidents.

FlexRIC CVE-2026-37224

EUVD-2026-33698 HIGH

Reachable Assertion (CWE-617)

2026-06-01 mitre

GHSA-9rvg-45qw-fjjr

Denial Of Service N A

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 01, 2026 - 21:22 vuln.today

CVSS changed

Jun 01, 2026 - 21:22 NVD

7.5 (HIGH)

CVE Published

Jun 01, 2026 - 00:00 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

FlexRIC v2.0.0 crashes when receiving a duplicate E2_SETUP_REQUEST from the same or spoofed E2 Node. The iApp registry enforces node ID uniqueness via assert() rather than graceful rejection. A remote unauthenticated attacker can crash the iApp process (port 36421) by sending two E2_SETUP_REQUESTs with the same E2 node configuration, triggering SIGABRT.

AnalysisAI

Remote denial of service in FlexRIC v2.0.0 allows unauthenticated attackers to crash the iApp process on TCP/36421 by sending two E2_SETUP_REQUEST messages reusing the same E2 node configuration, abusing an assert()-based uniqueness check that triggers SIGABRT. The flaw affects FlexRIC, the open-source Near-RT RIC implementation from Eurecom's Mosaic5G project, with CVSS 7.5 reflecting high availability impact and no public exploit identified at time of analysis.

Technical ContextAI

FlexRIC is a flexible, open-source Near Real-Time RAN Intelligent Controller (Near-RT RIC) for O-RAN/5G deployments, exposing the E2 Application Protocol on port 36421 to E2 Nodes (gNBs, eNBs). When an E2 Node initiates association via E2_SETUP_REQUEST, FlexRIC's internal iApp registry tracks node identities. The root cause is CWE-617 (Reachable Assertion): instead of returning an E2_SETUP_FAILURE on a duplicate node ID, the registry calls assert(), which under normal libc behavior raises SIGABRT and terminates the process. Because the assertion is reachable from network-supplied input before any authentication, any peer that can connect to the E2 endpoint can trigger it.

RemediationAI

No vendor-released patch identified at time of analysis; the upstream Mosaic5G GitLab project (https://gitlab.eurecom.fr/mosaic5g/flexric) and the third-party advisory should be monitored for a fixed release that replaces the assert() in the iApp node registry with a graceful E2_SETUP_FAILURE response. Until a patched build is available, restrict TCP/36421 (E2AP) to an allowlist of legitimate E2 Node management IPs via host firewall or RAN segmentation ACLs, place FlexRIC behind a dedicated VLAN or VRF reachable only by authorized gNB/eNB peers, and run the iApp under a supervisor (systemd Restart=always, Docker restart policy, or a process manager) so that a SIGABRT triggers automatic restart rather than prolonged outage; note the supervisor mitigation does not prevent repeated crash loops if an attacker keeps sending the trigger. Operators can also build FlexRIC with NDEBUG to compile out assert(), but this is risky because it silences other defensive assertions and is not an upstream-recommended configuration.