PT-2026-45556 · Flexric · Flexric

Minamikotor1 · CVE-2026-37234 · Published 2026-06-01 · Updated 2026-07-22

Positive Technologies (AI Summary)

CVSS v3.1

8.2

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H

Name of the Vulnerable Software and Affected Versions FlexRIC version 2.0.0

Description A flaw allows a single SCTP connection to bind multiple xapp ids by sending multiple E42 SETUP REQUESTs. Upon disconnection, the system only cleans up resources for the first registered xapp id, leaving subsequent xapp ids and their subscriptions as stale entries. A remote attacker can exploit this to leak subscription state in the iApp, which may lead to state corruption or resource exhaustion over time.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

CVE-2026-37234

Affected Products

Flexric

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/37xxx/CVE-2026-37234.json · Exploit
• 🔥 https://github.com/MinamiKotor1/oran-security-advisories-zhongnan-luo/blob/main/advisories/CVE-2026-37234.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-37234 · Security Note
• https://osv.dev/vulnerability/CVE-2026-37234 · Vendor Advisory
• https://gitlab.eurecom.fr/mosaic5g/flexric · Note
• https://t.me/cveNotify/166290 · Telegram Post
• https://t.me/cveNotify/211644 · Telegram Post