CVE-2026-36499 describes a resource exhaustion vulnerability in Open vSwitch version 3.6.90. The udpif_set_threads() function lacks an upper-bound check on the number of threads that can be requested. An attacker with write access to the OVSDB can exploit this to create an excessive number of handler or revalidation threads, potentially causing a denial of service by exhausting system resources. The vulnerability is classified under CWE-770 (Allocation of Resources Without Limits or Throttling). The CVSS v3.1 base score is 6.5 (medium severity), with network attack vector, low attack complexity, requiring privileges (OVSDB write access), no user interaction, and impact limited to availability.

Successful exploitation allows an attacker with OVSDB write access to cause denial of service by exhausting system resources through uncontrolled thread creation. There is no confidentiality or integrity impact reported. The attack requires some privilege (OVSDB write access) and can be performed remotely over the network.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict OVSDB write access to trusted administrators only to prevent exploitation.