It was found that when a volume fails to detach for any reason, the delete operation is retried forever, whereas the detach operation does not seem to try to detach more than once. This causes the delete to fail each time with 'VolumeInUse' error. The delete operation occurs every 30 seconds for each volume, which is causing a denial of service as the number of API requests being sent to the cloud-provider exceeds the API's rate-limit.
Changed CVSSv2/3 scores to reflect only a partial DoS rather then a full DoS.
This was fixed by a patch to 3.3, and 3.2 here: https://access.redhat.com/errata/RHBA-2017:0199