Submit #942311: O-RAN-SC SMO L-Release CWE-770 Allocation of Resources Without Limits or Throttling

Summary
The VES Collector is susceptible to coordinated low-rate traffic spread across multiple sources. Each source stays below per-source alarm thresholds, yet the cumulative load consumes collector resources and degrades availability without triggering any individual alert.

Vulnerability
Rate limiting and anomaly detection (where present) are evaluated per source and per individual event. There is no cumulative / cross-source correlation that accounts for event similarity. Multiple O-RUs each sending small bursts of near-identical (slightly mutated) heartbeats therefore evade detection while collectively saturating the collector.

Discovery
- 5 O-RUs sending 50 highly similar events each drove DoS probability above
- 0.8 while no individual source crossed its alarm threshold.

Expected Behavior
The collector should detect cumulative low-rate traffic correlated with event similarity across sources and mitigate the aggregate overload (global rate caps, similarity clustering, adaptive load shedding).

Actual Behavior
Events are processed normally; resources are consumed and responsiveness degrades, yet per-source alerts never fire because each source stays under threshold.

Impact
- Denial of Service (availability) via aggregate resource consumption.
- Hard to detect - distributed, low-rate, below per-source thresholds.

Issue: https://lf-o-ran-sc.atlassian.net/browse/SMO-202
Exploit: https://gist.github.com/fklement/9f217219b95f7ced94527a2d18b5f059

Steps to Reproduce
1. Deploy O-RAN-SC SMO/OAM L-Release with a reachable `ves-collector`.
2. From the downloaded gist-scripts:
```bash
cd ../Scripts
# Many sources, periodic small bursts (default 50 threads, 600s interval,
# 9-event bursts). Tune to mirror \"5 O-RUs x 50 events\":
THREAD_COUNT=5 INTERVAL=10 python3 low_and_slow.py

# Single-shot generator of slightly-mutated events (per-event eventId/seq/
# interval jitter) to seed similarity-based testing:
python3 slightly_changed_events_flood.py
```
3. Observe CPU usage and DoS probability rising while per-source alerts stay inactive.

Remediation
- Add global and tenant-wide rate caps in addition to per-source limits.
- Cluster events by similarity (eventName, fields, payload hash) and apply
cumulative thresholds across sources.
- Use adaptive load shedding driven by collector resource pressure, not just
per-source counters.

Detection
- Correlate event-similarity clusters with aggregate inbound rate.
- Alert when total ingestion rate or CPU rises while no single source is anomalous.
- Track count of distinct low-rate sources emitting near-identical events.

• Quelle: ⚠️ https://gist.github.com/fklement/9f217219b95f7ced94527a2d18b5f059
• Benutzer: fklement (UID 100684)
• Einreichung: 21.08.2026 12:29 (vor 28 Tagen)
• Moderieren: 17.09.2026 19:06 (27 days later)
• Status: Akzeptiert
• VulDB Eintrag: 406594 [O-RAN-SC SMO OAM 2025-06-10 VES Collector Denial of Service]
• Punkte: 20