CVE-2026-37234
Received Received - Intake
Memory Leak in FlexRIC v2.0.0 via SCTP Connections

Publication date: 2026-06-01

Last updated on: 2026-06-01

Assigner: MITRE

Description
FlexRIC v2.0.0 allows a single SCTP connection to bind multiple xapp_ids by sending multiple E42_SETUP_REQUESTs. On disconnect, only the first registered xapp_id's resources are cleaned up; subsequent xapp_ids and their subscriptions remain as stale entries. A remote attacker can exploit this to leak subscription state in the iApp, potentially causing resource exhaustion or state corruption over time.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-06-01
Last Modified
2026-06-01
Generated
2026-06-02
AI Q&A
2026-06-02
EPSS Evaluated
N/A
NVD
CVE-2026-37234
Affected Vendors & Products
Currently, no data is known.
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?

This vulnerability exists in FlexRIC v2.0.0 where a single SCTP connection can bind multiple xapp_ids by sending multiple E42_SETUP_REQUESTs.

When the connection disconnects, only the resources of the first registered xapp_id are cleaned up, while the subsequent xapp_ids and their subscriptions remain as stale entries.

A remote attacker can exploit this behavior to leak subscription state in the iApp, which may lead to resource exhaustion or state corruption over time.


How can this vulnerability impact me? :

The vulnerability can lead to resource exhaustion or state corruption within the affected application.

Because stale subscription entries remain after disconnects, system resources may be consumed unnecessarily, potentially degrading performance or causing failures.

An attacker exploiting this flaw remotely could cause these issues, impacting the stability and reliability of the system.


Ask Our AI Assistant
Need more information? Ask your question to get an AI reply (Powered by our expertise)
0/70
EPSS Chart