FlexRIC v2.0.0 allows a single SCTP connection to bind multiple xapp_ids by sending multiple E42_SETUP_REQUESTs. On disconnect, only the first registered xapp_id's resources are cleaned up; subsequent xapp_ids and their subscriptions remain as stale entries. A remote attacker can exploit this to leak subscription state in the iApp, potentially causing resource exhaustion or state corruption over time.
References
| Link | Resource |
|---|---|
| https://github.com/MinamiKotor1/oran-security-advisories-zhongnan-luo/blob/main/advisories/CVE-2026-37234.md | Exploit Mitigation Third Party Advisory |
| https://gitlab.eurecom.fr/mosaic5g/flexric | Product |
Configurations
History
05 Jun 2026, 20:42
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Mosaic5g
Mosaic5g flexric |
|
| References | () https://github.com/MinamiKotor1/oran-security-advisories-zhongnan-luo/blob/main/advisories/CVE-2026-37234.md - Exploit, Mitigation, Third Party Advisory | |
| References | () https://gitlab.eurecom.fr/mosaic5g/flexric - Product | |
| CPE | cpe:2.3:a:mosaic5g:flexric:2.0.0:*:*:*:*:*:*:* |
02 Jun 2026, 14:16
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 8.2 |
| CWE | CWE-400 |
01 Jun 2026, 21:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-06-01 21:16
Updated : 2026-06-05 20:42
NVD link : CVE-2026-37234
Mitre link : CVE-2026-37234
CVE.ORG link : CVE-2026-37234
JSON object : View
Products Affected
mosaic5g
- flexric
CWE
CWE-400
Uncontrolled Resource Consumption