CVE-2026-37220 Denial of service in n/a
A remote unauthenticated attacker can crash the FlexRIC near-RT RIC by closing an SCTP association prematurely, causing a denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-37220?
CVE-2026-37220 is a high-severity denial of service vulnerability in n/a, published on 1 Jun 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
FlexRIC v2.0.0 crashes when an SCTP association is closed before an E2_SETUP_REQUEST is sent. The near-RT RIC assumes a mapping between SCTP association and E2 node always exists in the cleanup path and enforces this via assert(). A remote unauthenticated attacker can crash the near-RT RIC (port 36421) by simply completing an SCTP handshake and immediately disconnecting, without sending any E2AP message.
Weakness: CWE-617
Which versions are affected by CVE-2026-37220?
How do I fix CVE-2026-37220?
No fix has been published for CVE-2026-37220 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-37220 being exploited?
There is no known exploitation of CVE-2026-37220 in the wild and no public exploit code.
Sources
Also known as GHSA-wgcx-v4x6-3pp9.