What is the CVSS score of CVE-2026-36501?

CVE-2026-36501 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.0%.

Which versions of OpenDaylight Controller are affected by CVE-2026-36501?

OpenDaylight SDN Controller v12.0.5 contains a remote denial-of-service vulnerability allowing any network attacker to crash the controller, disrupting SDN fabric control and network availability.

How to fix or mitigate CVE-2026-36501?

24 hours: Inventory all OpenDaylight Controller v12.0.5 instances; isolate from untrusted networks and implement network-level access controls (firewall rules) restricting controller access to trusted management subnets only. 7 days: Contact OpenDaylight foundation for patch timeline and availability; evaluate upgrade path to patched release. 30 days: Execute upgrade to patched OpenDaylight version or if unavailable, deploy network segmentation with dedicated management network, rate limiting on controller APIs, and IDS/WAF rules for anomalous Externalizable.readExternal() deserialization patterns.

OpenDaylight Controller CVE-2026-36501

EUVD-2026-34867 HIGH

Improper Input Validation (CWE-20)

2026-06-05 mitre

GHSA-w86h-g567-v7h5

Denial Of Service N A

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 09, 2026 - 18:59 vuln.today

CVSS changed

Jun 09, 2026 - 16:22 NVD

7.5 (HIGH)

CVE Published

Jun 05, 2026 - 00:00 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

An issue in the Externalizable.readExternal() component of Controller v12.0.5 allows attackers to cause a Denial of Service (DoS) via a crafted input.

AnalysisAI

Denial of service in OpenDaylight Controller v12.0.5 allows remote unauthenticated attackers to crash or render the SDN controller unavailable by sending crafted input to the Externalizable.readExternal() deserialization component. No public exploit identified at time of analysis, but SSVC flags the flaw as automatable with partial technical impact, and the network attack vector with low complexity makes opportunistic abuse plausible despite a very low EPSS score (0.02%).

Technical ContextAI

OpenDaylight (ODL) Controller is the core component of the OpenDaylight SDN platform, responsible for cluster coordination via Akka Raft and northbound/southbound communication with network devices. The vulnerable code path is Java's Externalizable.readExternal(), an interface used to customize serialization/deserialization of objects exchanged between clustered controller nodes and clients. CWE-20 (Improper Input Validation) at this layer means crafted serialized payloads are not adequately validated before being materialized into objects, allowing malformed data to drive the deserialization routine into an unrecoverable state. The linked PoC repository (ODL-Raft-Bug) suggests the issue surfaces in the Raft messaging path used for cluster consensus.

RemediationAI

No vendor-released patch identified at time of analysis; the references point to release notes and a PoC writeup rather than a tagged fix. Operators should monitor the OpenDaylight Titanium release notes (https://docs.opendaylight.org/en/stable-titanium/release-notes/projects/controller.html) and the issue tracker for a corrected build superseding 12.0.5. As compensating controls, restrict network reachability of the Controller's clustering, RESTCONF/NETCONF, and Akka remoting ports (typically 2550, 8181, 6633/6653) to a dedicated management VLAN or IPsec/mTLS overlay so the readExternal() deserialization path cannot be reached by untrusted clients - trade-off is added operational complexity for federated or multi-tenant SDN deployments. Enable Akka cluster authentication/TLS if not already configured, and consider running redundant controller nodes behind a health-checked load balancer so a single-node crash does not collapse the SDN control plane (does not prevent the crash but limits blast radius).