The vulnerability is in the Externalizable.readExternal() component of OpenDaylight Controller version 12.0.5. A specially crafted input can be processed by the controller, causing a denial of service by exhausting resources or causing the component to crash. The flaw is an input validation defect, mapped to CWE‑400. No remote code execution or confidentiality compromise is possible; the primary impact is loss of availability.

OpenDaylight Controller v12.0.5 is identified as the affected product. No other vendors, products, or version ranges are specified.

The CVSS score and EPSS are not available, and the vulnerability is not listed in CISA KEV, indicating limited public exploitation. The attack requires remote interaction with the controller’s Externalizable interface, likely over network protocols used by OpenDaylight. While the theoretical risk remains, lack of a confirmed exploit shortens the exploitation window. Network segmentation or traffic filtering can reduce the likelihood of successful attack.