CVE-2026-37222

Name of the Vulnerable Software and Affected Versions FlexRIC version 2.0.0

Description The software uses hardcoded assertions to validate Information Element (IE) counts in decoded E2AP messages. A remote unauthenticated attacker can send a valid E2AP PDU containing an unexpected number of IEs, such as an E2setupRequest with extra optional fields, to crash the near-RT RIC (port 36421) or iApp (port 36422) via SIGABRT. This occurs because the code requires exact IE counts instead of validating them against the ranges specified by the protocol.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.