The vulnerability stems from improper handling of Raft OpenSessionRequest messages. Based on:

1. The CWE-400 classification indicates uncontrolled resource consumption
2. The attack pattern involves flooding session requests
3. Standard Raft implementation patterns suggest session management components would handle these requests
4. The 'OpenSessionRequest' specificity in the advisory points directly to session creation functions
5. Atomix architecture typically locates Raft protocol handling in raft module classes While exact code isn't available, these functions represent the most logical entry points for session management in a Raft implementation, and their lack of rate limiting would directly enable the described DoS attack.