CVE-2026-37228

FlexRIC v2.0.0 contains a reachable assertion in e2aprecvsctpmsg src/lib/ep/e2apep.c. The function allocates a fixed 32KB receive buffer and enforces assertrc = 32,768 bytes to crash the near-RT RIC, iApp, E2 Agent, or xApp process via SIGABRT. No valid E2AP PDU is required. All four SCTP endpoin...

CVE-2025-7485

A vulnerability classified as problematic was found in Open5GS up to 2.7.3. Affected by this vulnerability is the function ngaprecvhandler/s1aprecvhandler/recvhandler of the component SCTP Partial Message Handler. The manipulation leads to reachable assertion. The attack needs to be approached...

CVE-2022-49838

In CVE-2022-49838, the Linux kernel SCTP code was fixed to clear out_curr when all fragments of the current message are pruned, preventing a NULL pointer dereference during dequeue. The issue manifested as list_del corruption and a crash traced through sctp_sched_fcfs_dequeue and related SCTP pat...

CVE-2022-49838

In the Linux kernel, the following vulnerability has been resolved: sctp: clear outcurr if all frag chunks of current msg are pruned A crash was reported by Zhen Chen: listdel corruption, ffffa035ddf01c18-next is NULL WARNING: CPU: 1 PID: 250682 at lib/listdebug.c:49 listdelentryvalid+0x59/0xe0...