CVE-2026-37235

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-37235

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-37235.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-37235

Published

2026-06-01T00:00:00Z

Modified

2026-07-16T03:49:22.546979548Z

Severity

7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator

Summary

[none]

Details

FlexRIC v2.0.0 trusts the xappid field from E42 message payloads without binding it to the sender's SCTP association. The validation function validxappid() only checks that the value is within the assigned range. A remote unauthenticated attacker can impersonate any xApp by specifying their xappid in requests sent to the iApp (port 36422), causing responses to be misrouted to the victim xApp. This can crash the victim xApp, the RIC, or the iApp itself through state inconsistencies in the red-black tree data structure.

Database specific

{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/37xxx/CVE-2026-37235.json",
    "cna_assigner": "mitre"
}

References

Affected packages

Git / gitlab.eurecom.fr/mosaic5g/flexric

Affected ranges

Type

GIT

Repo

https://gitlab.eurecom.fr/mosaic5g/flexric

Events

Introduced

1f04cc558ebc8da9de6a620762bc02f5db4ecb4a

Last affected

1f04cc558ebc8da9de6a620762bc02f5db4ecb4a

Database specific

{
    "cpe": "cpe:2.3:a:mosaic5g:flexric:2.0.0:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "2.0.0"
        },
        {
            "last_affected": "2.0.0"
        }
    ],
    "source": "CPE_STRING"
}

Affected versions

2.*

2.0.0

v2.*

v2.0.0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-37235.json"