CVE-2026-37232

An issue was discovered in OpenAirInterface5G 2.4.0 (nr-softmodem) in the E2SM-KPM RAN Function's PRB utilization metric calculation. The functions fill_RRU_PrbTotDl() and fill_RRU_PrbTotUl() in openair2/E2AP/RAN_FUNCTION/O-RAN/ran_func_kpm_subs.c (lines 182 and 197) compute PRB usage percentages by dividing by the difference of two consecutive total_prb_aggregate samples without checking for zero. When a malicious xApp sends a high volume of E42_RIC_SUBSCRIPTION_REQUESTs via the FlexRIC iApp (port 36422/SCTP), the E2 Agent generates KPM Indication reports at high frequency. If two consecutive sampling intervals yield identical PRB aggregate values, the divisor becomes zero, triggering SIGFPE and crashing the entire 5G base station process (nr-softmodem). This results in complete 5G cell service interruption for all connected UEs. No authentication is required.

• CWE-369

• https://github.com/MinamiKotor1/oran-security-advisories-zhongnan-luo/blob/main/advisories/CVE-2026-37232.mdMitigation, Third Party Advisory
• https://gitlab.eurecom.fr/oai/openairinterface5gProduct

Published

Jun 1, 2026

Last Modified

Jul 22, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-37227FlexRIC v2.0.0 contains reachable assert(0) calls in stub me…7.5
• CVE-2026-37228FlexRIC v2.0.0 contains a reachable assertion in e2ap_recv_s…7.5
• CVE-2026-37229FlexRIC v2.0.0 contains a reachable assertion in e2ap_create…7.5
• CVE-2026-3723A security flaw has been discovered in code-projects Simple …9.8
• CVE-2026-37230FlexRIC v2.0.0 crashes when the near-RT RIC receives a RIC_I…7.5
• CVE-2026-37231FlexRIC v2.0.0 uses a uint16_t counter for xapp_id assignmen…7.5
• CVE-2026-37233FlexRIC v2.0.0 contains an authorization bypass in the iApp'…7.5
• CVE-2026-37234FlexRIC v2.0.0 allows a single SCTP connection to bind multi…8.2
• CVE-2026-37235FlexRIC v2.0.0 trusts the xapp_id field from E42 message pay…7.5
• CVE-2026-3724A weakness has been identified in SourceCodester Patients Wa…8.8
• CVE-2026-3725A flaw has been found in 1024-lab/lab1024 SmartAdmin up to 3…8.8
• CVE-2026-3726A vulnerability has been found in Tenda F453 1.0.0.3. This a…8.8