What is the CVSS score of CVE-2026-37227?

CVE-2026-37227 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.1%.

Which versions of FlexRIC are affected by CVE-2026-37227?

FlexRIC v2.0.0 is vulnerable to remote, unauthenticated denial-of-service attacks that crash the near-RT RIC process, disrupting RAN intelligence operations.

How to fix or mitigate CVE-2026-37227?

Within 24 hours: Inventory all FlexRIC v2.0.0 instances in production and restrict network access to port 36421 using firewall rules to trusted E2AP sources only. Within 7 days: Implement rate limiting on E2AP PDU processing; deploy monitoring for E2nodeConfigurationUpdate and similar E2AP message anomalies; escalate to vendor for patch timeline commitment. Within 30 days: Evaluate upgrade path to a patched FlexRIC version once available; implement network segmentation to isolate RIC infrastructure from untrusted or external E2AP sources.

FlexRIC CVE-2026-37227

EUVD-2026-33700 HIGH

Reachable Assertion (CWE-617)

2026-06-01 mitre

GHSA-2m6w-7qwv-3jcx

Denial Of Service N A

7.5

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Primary rating from Vendor (mitre) · only source for this CVE.

CVSS VectorVendor: mitre

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 01, 2026 - 21:23 vuln.today

CVSS changed

Jun 01, 2026 - 21:22 NVD

7.5 (None) 7.5 (HIGH)

CVE Published

Jun 01, 2026 - 00:00 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

FlexRIC v2.0.0 contains reachable assert(0) calls in stub message handlers for whitelisted but unimplemented E2AP message types in the near-RT RIC. A remote unauthenticated attacker can send a decodable E2AP PDU of such a type (e.g., E2nodeConfigurationUpdate) to crash the near-RT RIC process (port 36421) via SIGABRT. The message passes whitelist validation but triggers an unconditional assertion in the handler.

AnalysisAI

Remote denial of service in FlexRIC v2.0.0 allows unauthenticated attackers to crash the near-RT RIC process by sending a decodable E2AP PDU (such as E2nodeConfigurationUpdate) to port 36421, triggering an unconditional assert(0) in stub handlers for whitelisted-but-unimplemented message types. CVSS 7.5 (AV:N/AC:L/PR:N/UI:N) with SSVC indicating automatable exploitation and partial technical impact; no public exploit identified at time of analysis and the vulnerability is not in CISA KEV.

Technical ContextAI

FlexRIC is an open-source near-Real-Time RAN Intelligent Controller (near-RT RIC) developed by EURECOM as part of the Mosaic5G project, implementing the O-RAN Alliance E2 Application Protocol (E2AP) on TCP/SCTP port 36421 to manage E2 nodes (gNBs, eNBs) in 5G/O-RAN deployments. The root cause is CWE-617 (Reachable Assertion): certain E2AP message types pass the whitelist filter in the message dispatcher but route to stub handlers containing assert(0) placeholders rather than proper logic or graceful rejection, causing the entire process to terminate via SIGABRT when such a message is received and decoded successfully. The CPE entry is genericized ('cpe:2.3:a:n/a:n/a:*') because FlexRIC is research/open-source software not formally cataloged in the NVD CPE dictionary.

RemediationAI

No vendor-released patch identified at time of analysis - neither the EURECOM GitLab repository nor the referenced advisory cites a fixed FlexRIC version in the provided data, so operators should monitor https://gitlab.eurecom.fr/mosaic5g/flexric for an updated release and review the advisory at https://github.com/MinamiKotor1/oran-security-advisories-zhongnan-luo/blob/main/advisories/CVE-2026-37227.md for vendor guidance. As compensating controls, restrict TCP/SCTP port 36421 to a trusted management VLAN or explicit E2 node IP allowlist via host firewall (iptables/nftables) or network ACL - this is the highest-leverage mitigation since E2AP is not intended for exposure to general networks; the trade-off is that any legitimate E2 node not on the allowlist will fail to connect. As a code-level workaround for operators building from source, patch the stub handlers for unimplemented E2AP message types (notably E2nodeConfigurationUpdate) to log and discard rather than assert(0), accepting the trade-off that unimplemented messages are silently dropped instead of crashing.