← Vulnerability feed

Vulnerability record · CVE-2026-37231 · published 1 June 2026

CVE-2026-37231: Mosaic5g flexric vulnerability

MMosaic5g · Flexric

FlexRIC v2.0.0 uses a uint16_t counter for xapp_id assignment but stores the value in uint32_t message fields. After 65,530+ E42_SETUP_REQUESTs, the 16-bit counter wraps around and produces duplicate xapp_ids. The iApp (port 36422) crashes when attempting to register a duplicate ID in its internal data structure. A remote attacker can trigger this by repeatedly connecting and requesting new xApp registrations.

7.5 CVSS 3.1 High EPSS 0.61% · top 52.8% CWE-191 · CWE-191
7.5CVSS 3.1 base score
0.61%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
2References, 1 tagged exploit
22 Jul 2026Last modified by NVD

Description

FlexRIC v2.0.0 uses a uint16_t counter for xapp_id assignment but stores the value in uint32_t message fields. After 65,530+ E42_SETUP_REQUESTs, the 16-bit counter wraps around and produces duplicate xapp_ids. The iApp (port 36422) crashes when attempting to register a duplicate ID in its internal data structure. A remote attacker can trigger this by repeatedly connecting and requesting new xApp registrations.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/MinamiKotor1/oran-security-advisories-zhongnan-luo/blob/main/advisories/CVE-2026-37231.md ExploitMitigationThird Party Advisory
https://gitlab.eurecom.fr/mosaic5g/flexric Product

Track CVE-2026-37231 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

8.2CVE-2026-37234Mosaic5g flexric uncontrolled resource consumption vulnerabilityFlexRIC v2.0.0 allows a single SCTP connection to bind multiple xapp_ids by sending multiple E42_SETUP_REQUESTs. On disconnect, only the first regist…EPSS 0.53%7.5CVE-2026-37226Mosaic5g flexric null pointer dereference vulnerabilityFlexRIC v2.0.0 crashes when the iApp receives an E42_RIC_SUBSCRIPTION_REQUEST referencing a non-existent E2 Node. The lookup function returns NULL, w…EPSS 0.64%7.5CVE-2026-37228Mosaic5g flexric vulnerabilityFlexRIC v2.0.0 contains a reachable assertion in e2ap_recv_sctp_msg() (src/lib/ep/e2ap_ep.c). The function allocates a fixed 32KB receive buffer and …EPSS 0.64%7.5CVE-2026-37229Mosaic5g flexric vulnerabilityFlexRIC v2.0.0 contains a reachable assertion in e2ap_create_pdu() triggered when ASN.1 PER decoding fails. A remote unauthenticated attacker can sen…EPSS 0.62%7.5CVE-2026-37230Mosaic5g flexric null pointer dereference vulnerabilityFlexRIC v2.0.0 crashes when the near-RT RIC receives a RIC_INDICATION message with a ran_func_id that does not exist in its registry. The lookup retu…EPSS 0.64%7.5CVE-2026-37233Mosaic5g flexric vulnerabilityFlexRIC v2.0.0 contains an authorization bypass in the iApp's xApp isolation mechanism. The equality function eq_xapp_ric_gen_id() in src/ric/iApp/xa…EPSS 0.57%7.5CVE-2026-37235Mosaic5g flexric improper access control vulnerabilityFlexRIC v2.0.0 trusts the xapp_id field from E42 message payloads without binding it to the sender's SCTP association. The validation function valid_…EPSS 0.57%9.8CVE-2014-0497Adobe Flash Player integer underflow allows remote code executionAdobe Flash Player contains an integer underflow (CWE-191) that allows remote attackers to execute arbitrary code via unspecified vectors. The flaw a…KEVEPSS 100%analysed

Source: NIST National Vulnerability Database (record CVE-2026-37231), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.