A malformed E42_RIC_SUBSCRIPTION_REQUEST that contains an empty ricEventTriggerDefinition field triggers a validation mismatch between the E42 decoder and the E2AP encoder in FlexRIC. The decoder mistakenly accepts the empty value as valid, but the encoder later asserts a non‑empty constraint, causing the iApp process to abort with SIGABRT. An attacker can send such a request to the iApp’s listening port 36422, disrupting the service without authentication or authorization. The weakness is classified as CWE‑617, a Cross‑Layer Validation Mismatch.

FlexRIC v2.0.0 – a 5G RIC open‑source component that listens on TCP port 36422. No other products or vendors are listed as affected.

The vulnerability has a CVSS score of 7.5 and no EPSS value available, and it is not catalogued in CISA’s KEV. Nonetheless, the flaw permits an unauthenticated remote attacker to crash the iApp, yielding a denial of service. The attack vector is over the network, requiring the attacker to construct a valid E42 layer request with an empty ricEventTriggerDefinition field and deliver it to the service endpoint.