← Vulnerability feed

Vulnerability record · CVE-2026-37234 · published 1 June 2026

CVE-2026-37234: Mosaic5g flexric uncontrolled resource consumption vulnerability

MMosaic5g · Flexric

FlexRIC v2.0.0 allows a single SCTP connection to bind multiple xapp_ids by sending multiple E42_SETUP_REQUESTs. On disconnect, only the first registered xapp_id's resources are cleaned up; subsequent xapp_ids and their subscriptions remain as stale entries. A remote attacker can exploit this to leak subscription state in the iApp, potentially causing resource exhaustion or state corruption over time.

8.2 CVSS 3.1 High EPSS 0.53% · top 57.2% CWE-400 · Uncontrolled resource consumption
8.2CVSS 3.1 base score
0.53%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
2References, 1 tagged exploit
22 Jul 2026Last modified by NVD

Description

FlexRIC v2.0.0 allows a single SCTP connection to bind multiple xapp_ids by sending multiple E42_SETUP_REQUESTs. On disconnect, only the first registered xapp_id's resources are cleaned up; subsequent xapp_ids and their subscriptions remain as stale entries. A remote attacker can exploit this to leak subscription state in the iApp, potentially causing resource exhaustion or state corruption over time.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/MinamiKotor1/oran-security-advisories-zhongnan-luo/blob/main/advisories/CVE-2026-37234.md ExploitMitigationThird Party Advisory
https://gitlab.eurecom.fr/mosaic5g/flexric Product

Track CVE-2026-37234 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

7.5CVE-2026-37226Mosaic5g flexric null pointer dereference vulnerabilityFlexRIC v2.0.0 crashes when the iApp receives an E42_RIC_SUBSCRIPTION_REQUEST referencing a non-existent E2 Node. The lookup function returns NULL, w…EPSS 0.64%7.5CVE-2026-37228Mosaic5g flexric vulnerabilityFlexRIC v2.0.0 contains a reachable assertion in e2ap_recv_sctp_msg() (src/lib/ep/e2ap_ep.c). The function allocates a fixed 32KB receive buffer and …EPSS 0.64%7.5CVE-2026-37229Mosaic5g flexric vulnerabilityFlexRIC v2.0.0 contains a reachable assertion in e2ap_create_pdu() triggered when ASN.1 PER decoding fails. A remote unauthenticated attacker can sen…EPSS 0.62%7.5CVE-2026-37230Mosaic5g flexric null pointer dereference vulnerabilityFlexRIC v2.0.0 crashes when the near-RT RIC receives a RIC_INDICATION message with a ran_func_id that does not exist in its registry. The lookup retu…EPSS 0.64%7.5CVE-2026-37231Mosaic5g flexric vulnerabilityFlexRIC v2.0.0 uses a uint16_t counter for xapp_id assignment but stores the value in uint32_t message fields. After 65,530+ E42_SETUP_REQUESTs, the …EPSS 0.61%7.5CVE-2026-37233Mosaic5g flexric vulnerabilityFlexRIC v2.0.0 contains an authorization bypass in the iApp's xApp isolation mechanism. The equality function eq_xapp_ric_gen_id() in src/ric/iApp/xa…EPSS 0.57%7.5CVE-2026-37235Mosaic5g flexric improper access control vulnerabilityFlexRIC v2.0.0 trusts the xapp_id field from E42 message payloads without binding it to the sender's SCTP association. The validation function valid_…EPSS 0.57%7.5CVE-2026-28318SolarWinds Serv-U unauthenticated POST request denial of serviceSolarWinds Serv-U crashes when it receives a specially crafted POST request using Content-Encoding: deflate, and the crash occurs without authenticat…KEVEPSS 1.9%analysed

Source: NIST National Vulnerability Database (record CVE-2026-37234), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.