CVE-2026-37226

The open-source RAN intelligent controller FlexRIC v2.0.0 is vulnerable to a crash in the iApp process (port 36422). A remote unauthenticated attacker can trigger this crash by sending an E42_RIC_SUBSCRIPTION_REQUEST that references a non-existent E2 Node using an arbitrary global_e2_node_id . Th...

CVE-2026-37223

FlexRIC v2.0.0 contains a reachable assertion in the iApp message dispatcher. The dispatcher validates incoming E2AP messages against a 9-entry whitelist using assert. A remote unauthenticated attacker can send any decodable E2AP PDU with a message type not in the whitelist to crash the iApp...

CVE-2026-37232

A divide-by-zero vulnerability exists in OpenAirInterface5G version 2.4.0 within the nr-softmodem component's E2SM-KPM RAN Function. Specifically, the functions fill_RRU_PrbTotDl() and fill_RRU_PrbTotUl() in openair2/E2AP/RAN_FUNCTION/O-RAN/ran_func_kpm_subs.c (lines 182 and 197) calculate PRB us...

PT-2026-45506

Name of the Vulnerable Software and Affected Versions FlexRIC version 2.0.0 Description A remote unauthenticated attacker can cause the iApp process on port 36422 to crash by sending an E42 RIC SUBSCRIPTION REQUEST that references a non-existent E2 Node. This occurs because the lookup function...