Vulnerability Description
FlexRIC v2.0.0 contains a reachable assertion in e2ap_recv_sctp_msg() (src/lib/ep/e2ap_ep.c). The function allocates a fixed 32KB receive buffer and enforces assert(rc < len) on the sctp_recvmsg() return value. A remote unauthenticated attacker can send a single SCTP message with payload >= 32,768 bytes to crash the near-RT RIC, iApp, E2 Agent, or xApp process via SIGABRT. No valid E2AP PDU is required. All four SCTP endpoint types (ports 36421 and 36422) share this vulnerable code path. In Release builds (NDEBUG), the stripped assertion leads to a signed-to-unsigned integer overflow and potential out-of-bounds read.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Mosaic5G | Flexric | 2.0.0 |
Related Weaknesses (CWE)
References
- https://github.com/MinamiKotor1/oran-security-advisories-zhongnan-luo/blob/main/ExploitMitigationThird Party Advisory
- https://gitlab.eurecom.fr/mosaic5g/flexricProduct
FAQ
What is CVE-2026-37228?
CVE-2026-37228 is a vulnerability with a CVSS score of 7.5 (HIGH). FlexRIC v2.0.0 contains a reachable assertion in e2ap_recv_sctp_msg() (src/lib/ep/e2ap_ep.c). The function allocates a fixed 32KB receive buffer and enforces assert(rc < len) on the sctp_recvmsg() ret...
How severe is CVE-2026-37228?
CVE-2026-37228 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-37228?
Check the references section above for vendor advisories and patch information. Affected products include: Mosaic5G Flexric.