High severity8.2NVD Advisory· Published Jun 1, 2026· Updated Jun 5, 2026

CVE-2026-37234

Description

FlexRIC v2.0.0 allows a single SCTP connection to bind multiple xapp_ids by sending multiple E42_SETUP_REQUESTs. On disconnect, only the first registered xapp_id's resources are cleaned up; subsequent xapp_ids and their subscriptions remain as stale entries. A remote attacker can exploit this to leak subscription state in the iApp, potentially causing resource exhaustion or state corruption over time.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Minamikotor1/Oran Security Advisories Zhongnan Luoreferences2 versions
(expand)+ 1 more
- (no CPE)
- (no CPE)
FlexRIC/FlexRIC2 versions
cpe:2.3:a:mosaic5g:flexric:2.0.0:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:mosaic5g:flexric:2.0.0:*:*:*:*:*:*:*
- (no CPE)range: =2.0.0

Patches

Vulnerability mechanics

References

github.com/MinamiKotor1/oran-security-advisories-zhongnan-luo/blob/main/advisories/CVE-2026-37234.mdnvdExploitMitigationThird Party Advisory

News mentions

FlexRIC v2.0.0: Ten High-Severity Assertions and Logic Flaws Disclosed
Vypr Intelligence · Jun 1, 2026

cvss	0.533
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000