← Back

CVE-2026-37229

nvd nist
Published: Jun 1, 2026Modified: Jul 22, 2026

JSON object

Loading...
7.5
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Exploitability: 3.9 / Impact: 3.6
Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

FlexRIC v2.0.0 contains a reachable assertion in e2ap_create_pdu() triggered when ASN.1 PER decoding fails. A remote unauthenticated attacker can send any non-PER byte sequence (e.g., a single 0x00 byte) over SCTP to the near-RT RIC (port 36421) or iApp (port 36422) to crash the process via SIGABRT. The assertion is reached before any protocol-level validation occurs. All three E2AP protocol versions (v1.01, v2.03, v3.01) are affected.

Affected (1)

Products: Mosaic5g: Flexric
Mosaic5g
1 product
Flexric
Configuration A
1 vulnerable
Vulnerable SoftwareAffected Versions
Flexric
Version 2.0.0

Related CWEs

CWE-617
Reachable Assertion
The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary.

References (2)

Source: cve@mitre.org
ExploitMitigationThird Party Advisory
Source: cve@mitre.org
Product

Timeline

No history available yet.