Junglewise Threat Intelligence

CVE-2026-37224: EURECOM FlexRIC denial of service via duplicate E2 setup request

CVE-2026-37224 · Severity: info · CVSS 7.5 · Published 2026-06-01

Technologies: EURECOM FlexRIC. Vendors: EURECOM.

Executive brief

EURECOM FlexRIC, a controller used in 5G radio access networks, is vulnerable to a remote crash. An attacker can send a specific sequence of duplicate connection requests to the system, causing the controller process to shut down unexpectedly. This results in a denial of service, disrupting the management of the cellular network infrastructure.

Technical details

A reachable assertion vulnerability (CWE-617) exists in FlexRIC v2.0.0 within the E2 node registry component (src/lib/msg_hand/reg_e2_nodes.c). The function add_reg_e2_node() uses an assert() statement to enforce GlobalE2node_ID uniqueness instead of implementing graceful error handling for duplicate registrations. A remote, unauthenticated attacker can trigger this assertion by sending two E2_SETUP_REQUEST messages with the same node configuration over SCTP to port 36421. This causes the iApp process to receive a SIGABRT signal and terminate, leading to a complete denial of service. As of the advisory date, no official patch is available, and users are advised to restrict SCTP access to trusted nodes.

Affected products

  • EURECOM FlexRIC v2.0.0 through commit 6a595d8b

Timeline

  • 2026-06-01: disclosed
  • 2026-06-01: advisory

References

Related threats