CVE-2026-37232

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-37232

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-37232.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-37232

Published

2026-06-01T00:00:00Z

Modified

2026-08-12T03:51:08.665161964Z

Severity

8.6 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H CVSS Calculator

Summary

[none]

Details

An issue was discovered in OpenAirInterface5G 2.4.0 (nr-softmodem) in the E2SM-KPM RAN Function's PRB utilization metric calculation. The functions fillRRUPrbTotDl() and fillRRUPrbTotUl() in openair2/E2AP/RANFUNCTION/O-RAN/ranfunckpmsubs.c (lines 182 and 197) compute PRB usage percentages by dividing by the difference of two consecutive totalprbaggregate samples without checking for zero. When a malicious xApp sends a high volume of E42RICSUBSCRIPTION_REQUESTs via the FlexRIC iApp (port 36422/SCTP), the E2 Agent generates KPM Indication reports at high frequency. If two consecutive sampling intervals yield identical PRB aggregate values, the divisor becomes zero, triggering SIGFPE and crashing the entire 5G base station process (nr-softmodem). This results in complete 5G cell service interruption for all connected UEs. No authentication is required.

Database specific

{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/37xxx/CVE-2026-37232.json",
    "cna_assigner": "mitre"
}

References

Affected packages

Git / gitlab.eurecom.fr/oai/openairinterface5g

Affected ranges

Type

GIT

Repo

https://gitlab.eurecom.fr/oai/openairinterface5g

Events

Introduced

91e7030cf8adefce502f0701fb7aaa1d512379df

Last affected

91e7030cf8adefce502f0701fb7aaa1d512379df

Database specific

Show details

{
    "cpe": "cpe:2.3:a:openairinterface:openairinterface5g:2.4.0:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "2.4.0"
        },
        {
            "last_affected": "2.4.0"
        }
    ],
    "source": "CPE_STRING"
}

Affected versions

2.*

2.4.0

2025.*

2025.w49

v2.*

v2.4.0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-37232.json"