CVE-2026-37228

FlexRIC v2.0.0 contains a reachable assertion in e2ap_recv_sctp_msg() (src/lib/ep/e2ap_ep.c). The function allocates a fixed 32KB receive buffer and enforces assert(rc < len) on the sctp_recvmsg() return value. A remote unauthenticated attacker can send a single SCTP message with payload >= 32,768 bytes to crash the near-RT RIC, iApp, E2 Agent, or xApp process via SIGABRT. No valid E2AP PDU is required. All four SCTP endpoint types (ports 36421 and 36422) share this vulnerable code path. In Release builds (NDEBUG), the stripped assertion leads to a signed-to-unsigned integer overflow and potential out-of-bounds read.

• CWE-617

• https://github.com/MinamiKotor1/oran-security-advisories-zhongnan-luo/blob/main/advisories/CVE-2026-37228.mdExploit, Mitigation, Third Party Advisory
• https://gitlab.eurecom.fr/mosaic5g/flexricProduct

Published

Jun 1, 2026

Last Modified

Jul 22, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-37222FlexRIC v2.0.0 uses hardcoded assertions to validate Informa…7.5
• CVE-2026-37223FlexRIC v2.0.0 contains a reachable assertion in the iApp me…7.5
• CVE-2026-37224FlexRIC v2.0.0 crashes when receiving a duplicate E2_SETUP_R…7.5
• CVE-2026-37225FlexRIC v2.0.0 crashes when the iApp receives an E42_RIC_SUB…7.5
• CVE-2026-37226FlexRIC v2.0.0 crashes when the iApp receives an E42_RIC_SUB…7.5
• CVE-2026-37227FlexRIC v2.0.0 contains reachable assert(0) calls in stub me…7.5
• CVE-2026-37229FlexRIC v2.0.0 contains a reachable assertion in e2ap_create…7.5
• CVE-2026-3723A security flaw has been discovered in code-projects Simple …9.8
• CVE-2026-37230FlexRIC v2.0.0 crashes when the near-RT RIC receives a RIC_I…7.5
• CVE-2026-37231FlexRIC v2.0.0 uses a uint16_t counter for xapp_id assignmen…7.5
• CVE-2026-37232An issue was discovered in OpenAirInterface5G 2.4.0 (nr-soft…8.6
• CVE-2026-37233FlexRIC v2.0.0 contains an authorization bypass in the iApp'…7.5