CVE-2026-36501 Overview
CVE-2026-36501 is a denial-of-service vulnerability in the Externalizable.readExternal() component of OpenDaylight Controller v12.0.5. Attackers can submit crafted input to the deserialization routine to exhaust resources and disrupt controller availability. The flaw is network-reachable, requires no authentication, and needs no user interaction. The issue is tracked under [CWE-20: Improper Input Validation] and affects the Raft consensus implementation used by the controller.
Critical Impact
Unauthenticated remote attackers can crash or hang OpenDaylight Controller v12.0.5, disrupting software-defined networking (SDN) control plane operations across managed network infrastructure.
Affected Products
- OpenDaylight Controller v12.0.5
- OpenDaylight Raft component (per researcher disclosure)
- Downstream SDN platforms bundling the affected controller release
Discovery Timeline
- 2026-06-05 - CVE-2026-36501 published to NVD
- 2026-06-09 - Last updated in NVD database
Technical Details for CVE-2026-36501
Vulnerability Analysis
The vulnerability resides in the Externalizable.readExternal() method used by OpenDaylight Controller v12.0.5. The Externalizable interface in Java allows objects to define their own custom serialization format through readExternal() and writeExternal() implementations. When the controller deserializes input from a remote peer, malformed data is processed without sufficient validation. A crafted payload triggers a denial-of-service condition that disrupts controller availability.
Because the affected code path is reachable from the network and requires no privileges, an attacker capable of delivering serialized input to the controller can disrupt the SDN control plane. Loss of the controller affects flow programming and topology management for every switch and router managed by the cluster. Additional analysis of the Raft-related fault is published in the GitHub ODL Raft Bug Info repository.
Root Cause
The root cause is improper input validation [CWE-20] inside a custom Externalizable.readExternal() implementation. The method does not constrain or sanity-check deserialized fields before allocating resources or driving downstream logic. A crafted object stream forces the controller into a state that exhausts CPU, memory, or thread resources.
Attack Vector
Exploitation occurs over the network against an exposed controller service. An attacker submits a malicious serialized object to a listener that invokes readExternal() during deserialization. No credentials and no user interaction are required. The result is degraded or unavailable control-plane services for the affected OpenDaylight cluster.
No public proof-of-concept exploit code is available. Refer to the OpenDaylight Release Notes for upstream details.
Detection Methods for CVE-2026-36501
Indicators of Compromise
- Unexplained restarts, crashes, or hangs of OpenDaylight Controller processes running v12.0.5.
- Spikes in JVM heap usage, garbage collection time, or thread counts on controller nodes preceding loss of service.
- Raft leader election churn or repeated cluster member timeouts in controller logs without a corresponding infrastructure event.
- Inbound connections delivering Java serialized payloads (magic bytes AC ED 00 05) from untrusted sources to controller ports.
Detection Strategies
- Monitor controller logs for exceptions originating in readExternal() call paths or Raft serialization classes.
- Apply network IDS signatures that flag Java serialization streams to controller management and clustering ports from unexpected sources.
- Correlate controller availability metrics with northbound API failures to identify control-plane disruption events.
Monitoring Recommendations
- Enable JVM telemetry (heap, GC, thread, and CPU metrics) and alert on sustained anomalies on controller nodes.
- Centralize OpenDaylight logs and Raft cluster events in a SIEM for correlation with network reachability tests.
- Track controller cluster quorum status and alert when leader changes exceed a baseline frequency.
How to Mitigate CVE-2026-36501
Immediate Actions Required
- Restrict network access to OpenDaylight Controller clustering and management ports to trusted management networks only.
- Inventory deployments running Controller v12.0.5 and prioritize upgrade planning.
- Place controller nodes behind authenticated, mutually-TLS-enforced channels for cluster communication.
Patch Information
Review the OpenDaylight Release Notes for the Controller project and upgrade to a fixed release once available. Until a vendor-supplied patch is applied, treat the affected service interfaces as untrusted and limit exposure.
Workarounds
- Segment controller clusters onto isolated management VLANs with strict ACLs that deny untrusted serialized input.
- Terminate controller traffic behind a reverse proxy or service mesh that authenticates peers before deserialization.
- Disable or firewall any unused listeners that accept Externalizable payloads from outside the cluster.
# Configuration example: restrict controller ports to trusted management subnet
iptables -A INPUT -p tcp --dport 2550 -s 10.10.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 2550 -j DROP
iptables -A INPUT -p tcp --dport 6653 -s 10.10.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 6653 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
