


Perceptive Security
SOC/SIEM Consultancy

FlexRIC v2.0.0 contains reachable assert(0) calls in stub message handlers for whitelisted but unimplemented E2AP message types in the near-RT RIC. A remote una…
Published:
31 May 2026 at 22:00:00
Alert date:
1 June 2026 at 22:04:03
Source:
nvd.nist.gov
Critical Infrastructure, Network Infrastructure
FlexRIC v2.0.0 contains a denial of service vulnerability in its E2AP message handlers. The vulnerability exists in stub message handlers for whitelisted but unimplemented E2AP message types in the near-RT RIC component. Remote unauthenticated attackers can exploit this by sending specially crafted E2AP PDU messages that pass whitelist validation but trigger unconditional assertions. When exploited, the vulnerability causes the near-RT RIC process to crash via SIGABRT signal on port 36421. The issue affects message types like E2nodeConfigurationUpdate that are whitelisted but lack proper implementation, making the system vulnerable to remote denial of service attacks.
Technical details
Mitigation steps:
Affected products:
FlexRIC
Related links:
https://nvd.nist.gov/vuln/detail/CVE-2026-37227
https://github.com/MinamiKotor1/oran-security-advisories-zhongnan-luo/blob/main/advisories/CVE-2026-37227.md
https://gitlab.eurecom.fr/mosaic5g/flexric
Related CVE's:
Related threat actors:
IOC's:
This article was created with the assistance of AI technology by Perceptive.
