FlexRIC v2.0.0 crashes when an SCTP association is closed before an E2_SETUP_REQUEST is sent. The near-RT RIC assumes a mapping between SCTP association and E2 node always exists in the cleanup path and enforces this via assert(). A remote unauthenticated attacker can crash the near-RT RIC (port 36421) by simply completing an SCTP handshake and immediately disconnecting, without sending any E2AP message.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00081.

Exploitation none

Automatable yes

Technical Impact partial

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
n/a n/a affected
Version Status Constraints
n/a affected —

No data.

No data.

OpenCVE Enrichment is a feature of OpenCVE that uses AI to automatically link vendors and products to CVEs. Learn more on GitHub.

No data.

Project Subscriptions

No data.

Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://github.com/MinamiKotor1/oran-security-advisories-zhongnan-luo/blob/main/advisories/CVE-2026-37220.md cve-icon cve-icon
https://gitlab.eurecom.fr/mosaic5g/flexric cve-icon cve-icon
History

Mon, 01 Jun 2026 21:30:00 +0000

Type Values Removed Values Added
Title SCTP Handshake Mismanagement Causes Remote Denial of Service in FlexRIC

Mon, 01 Jun 2026 19:15:00 +0000

Type Values Removed Values Added
Title FlexRIC Near‑RT RIC Crash and Denial of Service via SCTP Handshake
Weaknesses CWE-682

Mon, 01 Jun 2026 17:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-617
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 01 Jun 2026 17:15:00 +0000

Type Values Removed Values Added
Title FlexRIC Near‑RT RIC Crash and Denial of Service via SCTP Handshake
Weaknesses CWE-682

Mon, 01 Jun 2026 15:00:00 +0000

Type Values Removed Values Added
Description FlexRIC v2.0.0 crashes when an SCTP association is closed before an E2_SETUP_REQUEST is sent. The near-RT RIC assumes a mapping between SCTP association and E2 node always exists in the cleanup path and enforces this via assert(). A remote unauthenticated attacker can crash the near-RT RIC (port 36421) by simply completing an SCTP handshake and immediately disconnecting, without sending any E2AP message.
References

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: mitre

Published:

Updated: 2026-06-01T16:46:53.924Z

Reserved: 2026-04-06T00:00:00.000Z

Link: CVE-2026-37220

cve-icon Vulnrichment

Updated: 2026-06-01T16:45:47.834Z

cve-icon NVD

Status : Deferred

Published: 2026-06-01T15:16:34.163

Modified: 2026-06-01T18:09:03.137

Link: CVE-2026-37220

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-06-01T21:15:15Z

Weaknesses