Executive brief
A vulnerability in the OpenDayLight Controller, a platform used for software-defined networking, can allow an attacker to crash the system. By sending a specially crafted message to the controller, an attacker can force the application to exhaust its available memory. This results in a complete service outage (Denial of Service), disrupting the management of the network infrastructure.
Technical details
A Denial of Service vulnerability exists in the Externalizable.readExternal() component of the OpenDayLight Controller's Raft implementation. Specifically, the AE, SS, and ServerConfigurationPayload classes process incoming 'entryCount' values using in.readInt() and pass them directly to ImmutableList.builderWithExpectedSize() without bounds checking. A remote attacker who can reach the Pekko cluster port (typically 2550) can send a crafted AppendEntries (AE) message with an entryCount set to Integer.MAX_VALUE. This triggers a massive memory allocation attempt (~16 GB), leading to an OutOfMemoryError and subsequent JVM shutdown.
Affected products
- OpenDayLight Controller (OpenDayLight) 12.0.5
Timeline
- 2026-06-05: disclosed: Vulnerability published to NVD