CVE-2026-37234 affects FlexRIC v2.0.0, allowing a remote attacker to exploit the handling of multiple E42_SETUP_REQUESTs over a single SCTP connection. The system only cleans up resources for the first registered xapp_id upon disconnect, leaving subsequent xapp_ids and their subscriptions as stale entries. This can lead to leaking subscription state within the iApp, which may cause resource exhaustion or state corruption over time. The vulnerability is classified under CWE-400 (Uncontrolled Resource Consumption) and has a CVSS v3.1 score of 8.2, indicating high severity. There is no known exploit in the wild and no vendor-provided patch or remediation information at this time.

The vulnerability can be exploited remotely without privileges or user interaction to cause resource exhaustion or state corruption in the affected FlexRIC iApp. This may degrade service availability or stability due to accumulation of stale subscription state. There is no indication of confidentiality impact, but integrity is impacted due to potential state corruption. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, monitor for unusual resource usage patterns related to SCTP connections and consider limiting the number of E42_SETUP_REQUESTs per connection if possible. Avoid relying on this component in high-risk environments without additional safeguards.