FlexRIC v2.0.0 contains a vulnerability triggered by an E42_RIC_SUBSCRIPTION_REQUEST message with an empty ricEventTriggerDefinition field. The E42 layer decoder incorrectly accepts this message as valid, but the E2AP encoder asserts a non-empty constraint and aborts the process when forwarding the request. This cross-layer validation mismatch allows a remote unauthenticated attacker to crash the iApp process (listening on port 36422) by sending a crafted request, resulting in a denial of service condition. There is no CVSS score or vendor advisory available, and no patch or mitigation has been confirmed.

The vulnerability allows a remote unauthenticated attacker to cause a denial of service by crashing the FlexRIC iApp process. This disrupts the affected service by terminating the process via a SIGABRT signal. There is no indication of code execution, data leakage, or privilege escalation from the provided information.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider restricting access to the iApp process port (36422) to trusted sources only to reduce exposure. Monitor for unusual crashes or restarts of the iApp process. Do not assume the vulnerability is mitigated without vendor confirmation.