VulnSocial

CVE-2026-37229Patch(mosaic5g / flexric)

LOWCVSS 7.5 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Patch mosaic5g flexric systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

FlexRIC v2.0.0 contains a reachable assertion in e2ap_create_pdu() triggered when ASN.1 PER decoding fails. A remote unauthenticated attacker can send any non-PER byte sequence (e.g., a single 0x00 byte) over SCTP to the near-RT RIC (port 36421) or iApp (port 36422) to crash the process via SIGABRT. The assertion is reached before any protocol-level validation occurs. All three E2AP protocol versions (v1.01, v2.03, v3.01) are affected.

mosaic5g CVEsBack to dashboard
0.5/ 10 priority

Sources & remediation

Exploit / PoC references
Other references
Weakness type (CWE)
CWE-617

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

NONE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • flexric

Threat summary

  • Patch or workaround signal is available
  • 1 mentions across 1 observed day

What's happening

  • Patch or workaround mentioned in 1 signal
  • Technical details provided in 1 signal
  • 1 total mentions across 1 day

Affected systems

Vendors
mosaic5g
Products
flexric

1 version affected across 1 product

Deep dive

Activity timeline1 mentions / 1d
00111Mentions · 2026-07-28: 1Patch / Workaround · 2026-07-28: 1Technical Details · 2026-07-28: 107-28
Signal classification1 categories
Patch
1100.0%
Full discourse1 post
  • DFIR Lab@DFIR_Lab
    Patch

    🚨 HIGH: CVE-2026-37229 (CVSS 7.5) FlexRIC v2[.]0[.]0 reachable assertion flaw allows remote unauthenticated DoS. Single malformed byte over SCTP crashes near-RT RIC/iApp processes. Affects all E2AP versions. Patch immediately. #CVE #Vulnerability #PatchNow https://t.co/HAi0M1Yinz

    Post summary

    The tweet reports CVE-2026-37229 as a reachable assertion flaw that allows remote unauthenticated DoS via a malformed SCTP byte and urges users to patch immediately.

    0000034
    97 followersView on X
CPE platform detail1 entries

1 of 1 entries

PartVendorProductVersionTarget SWTarget HW
Appmosaic5gflexric2.0.0--

Explore more

Back to dashboardmosaic5g CVEsflexric vulnerabilities