CVE-2026-37223

Name of the Vulnerable Software and Affected Versions FlexRIC version 2.0.0

Description The iApp message dispatcher contains a reachable assertion. The dispatcher uses the assert() function to validate incoming E2AP messages against a 9-entry whitelist. A remote unauthenticated attacker can send a decodable E2AP PDU with a message type not present in the whitelist, triggering a SIGABRT (a signal sent to a process to force it to abort) and crashing the iApp process on port 36422. Because iApp and the near-RT RIC share a single process, this action terminates the entire RIC service, resulting in the disconnection of all xApps and E2 Nodes.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.