PatchTheCVEmosaic5g vulnerabilities
Recent CVEs affecting mosaic5g products. 8 tracked.
mosaic5g has 8 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 0. Most recent: 2026-06-01. Highest priority: CVE-2026-37226 (score 49/100).
- CVE-2026-37234 HIGH 8.2 DOWNGRADE FlexRIC v2.0.0 allows a single SCTP connection to bind multiple xapp_ids by sending multiple E42_SETUP_REQUEST
- CVE-2026-37226 HIGH 7.5 DOWNGRADE FlexRIC v2.0.0 crashes when the iApp receives an E42_RIC_SUBSCRIPTION_REQUEST referencing a non-existent E2 No
- CVE-2026-37228 HIGH 7.5 DOWNGRADE FlexRIC v2.0.0 contains a reachable assertion in e2ap_recv_sctp_msg() (src/lib/ep/e2ap_ep.c)
- CVE-2026-37229 HIGH 7.5 DOWNGRADE FlexRIC v2.0.0 contains a reachable assertion in e2ap_create_pdu() triggered when ASN.1 PER decoding fails
- CVE-2026-37230 HIGH 7.5 DOWNGRADE FlexRIC v2.0.0 crashes when the near-RT RIC receives a RIC_INDICATION message with a ran_func_id that does not
- CVE-2026-37235 HIGH 7.5 DOWNGRADE FlexRIC v2.0.0 trusts the xapp_id field from E42 message payloads without binding it to the sender's SCTP asso
- CVE-2026-37231 HIGH 7.5 DOWNGRADE FlexRIC v2.0.0 uses a uint16_t counter for xapp_id assignment but stores the value in uint32_t message fields
- CVE-2026-37233 HIGH 7.5 DOWNGRADE FlexRIC v2.0.0 contains an authorization bypass in the iApp's xApp isolation mechanism
FAQ
How do I fix mosaic5g vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is mosaic5g being exploited right now?
None of the tracked mosaic5g CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which mosaic5g CVE should I patch first?
CVE-2026-37226 currently ranks highest (49/100): FlexRIC v2.0.0 crashes when the iApp receives an E42_RIC_SUBSCRIPTION_REQUEST referencing a non-existent E2 No.