CVE-2026-37234 Denial of service in n/a
Remote attackers can cause resource exhaustion and state corruption in FlexRIC by exploiting improper cleanup of multiple SCTP connections.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-37234?
CVE-2026-37234 is a high-severity denial of service vulnerability in n/a, published on 1 Jun 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
FlexRIC v2.0.0 allows a single SCTP connection to bind multiple xapp_ids by sending multiple E42_SETUP_REQUESTs. On disconnect, only the first registered xapp_id's resources are cleaned up; subsequent xapp_ids and their subscriptions remain as stale entries. A remote attacker can exploit this to leak subscription state in the iApp, potentially causing resource exhaustion or state corruption over time.
Weakness: CWE-400
Which versions are affected by CVE-2026-37234?
It affects 1 product.
Products include Mosaic5g Flexric.
How do I fix CVE-2026-37234?
No fix has been published for CVE-2026-37234 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-37234 being exploited?
There is no known exploitation of CVE-2026-37234 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-vcc7-hjgh-mx9v.