Is CVE-2026-37224 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-37224 being exploited in the wild.

How severe is CVE-2026-37224?

Informational severity, with a CVSS score of 7.5, published 1 June 2026.

Which products and versions are affected?

EURECOM FlexRIC v2.0.0 through commit 6a595d8b.

Is there a fix for CVE-2026-37224?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-37224 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-37224?

Check whether you run EURECOM FlexRIC at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-37224: EURECOM FlexRIC denial of service via duplicate E2 setup request

CVE-2026-37224 · Severity: info · CVSS 7.5 · Published 2026-06-01

EURECOM FlexRIC, a controller used in 5G radio access networks, is vulnerable to a remote crash. An attacker can send a specific sequence of duplicate connection requests to the system, causing the controller process to shut down unexpectedly. This results in a denial of service, disrupting the management of the cellular network infrastructure.

Technologies: EURECOM FlexRIC. Vendors: EURECOM.

Quick answers

Is CVE-2026-37224 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-37224 being exploited in the wild.
How severe is CVE-2026-37224?: Informational severity, with a CVSS score of 7.5, published 1 June 2026.
Which products and versions are affected?: EURECOM FlexRIC v2.0.0 through commit 6a595d8b.
Is there a fix for CVE-2026-37224?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-37224 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-37224?: Check whether you run EURECOM FlexRIC at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A reachable assertion vulnerability (CWE-617) exists in FlexRIC v2.0.0 within the E2 node registry component (src/lib/msg_hand/reg_e2_nodes.c). The function add_reg_e2_node() uses an assert() statement to enforce GlobalE2node_ID uniqueness instead of implementing graceful error handling for duplicate registrations. A remote, unauthenticated attacker can trigger this assertion by sending two E2_SETUP_REQUEST messages with the same node configuration over SCTP to port 36421. This causes the iApp process to receive a SIGABRT signal and terminate, leading to a complete denial of service. As of the advisory date, no official patch is available, and users are advised to restrict SCTP access to trusted nodes.

Affected products

EURECOM FlexRIC v2.0.0 through commit 6a595d8b

Timeline

2026-06-01: disclosed
2026-06-01: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.