CVE-2026-37229 Denial of service in n/a

High 7.5 Published 1 Jun 2026 Updated 2 Jun 2026

Remote unauthenticated attackers can crash FlexRIC processes by sending malformed SCTP packets, causing a denial of service in the near-RT RIC environment.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2026-37229?

CVE-2026-37229 is a high-severity denial of service vulnerability in n/a, published on 1 Jun 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

FlexRIC v2.0.0 contains a reachable assertion in e2ap_create_pdu() triggered when ASN.1 PER decoding fails. A remote unauthenticated attacker can send any non-PER byte sequence (e.g., a single 0x00 byte) over SCTP to the near-RT RIC (port 36421) or iApp (port 36422) to crash the process via SIGABRT. The assertion is reached before any protocol-level validation occurs. All three E2AP protocol versions (v1.01, v2.03, v3.01) are affected.

Weakness: CWE-617

Which versions are affected by CVE-2026-37229?

It affects 1 product.

Products include Mosaic5g Flexric.

How do I fix CVE-2026-37229?

No fix has been published for CVE-2026-37229 yet. Limit exposure of the affected software until one is available.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2026-37229 being exploited?

There is no known exploitation of CVE-2026-37229 in the wild and no public exploit code.

Sources

Also known as GHSA-gg3p-8qg4-465f.