Executive brief
O-RAN-SC SMO OAM is a management platform for Open RAN network infrastructure. The VES Collector component, which ingests event telemetry from network elements, is vulnerable to a denial-of-service attack via maliciously formatted chunked payloads. An attacker can remotely exhaust server memory and CPU resources, disrupting network monitoring and management capabilities.
Technical details
This is a CWE-770 resource exhaustion vulnerability in the VES Collector endpoint (HTTP listener on port 8080, path /eventListener/v7). The vulnerability stems from improper handling of chunked HTTP Transfer-Encoding in JSON event payloads. An attacker can send legitimate-looking VES events (e.g., heartbeat messages) split across multiple small chunks, forcing the collector to repeatedly allocate memory buffers while reassembling the payload. By varying chunk timing and payload sizes, and sending multiple concurrent requests from different source identities, an attacker can exhaust system resources without requiring authentication. The attack is network-accessible and has been publicly disclosed with proof-of-concept code demonstrating payload chunking and multi-threaded request patterns. Vendor response status is unknown at this time.
Affected products
- O-RAN-SC SMO OAM 2025-06-10
Timeline
- 2026-06-26: disclosed: Proof-of-concept code published on GitHub (payload_chunking.py).
- 2026-09-18: advisory: CVE-2026-93309 published on NVD.
- 2025-06-10: other: Vulnerability identified in O-RAN-SC SMO OAM version dated 2025-06-10.