15 matches found
APM Server 8.19.24, 9.4.9, 9.5.6 Security Update (ESA-2026-236)
Allocation of Resources Without Limits or Throttling in APM Server Leading to Denial of Service Allocation of Resources Without Limits or Throttling CWE-770 in APM Server can lead to denial of service via Oversized Serialized Data Payloads CAPEC-231. An attacker who can send OpenTelemetry OTLP da...
Malicious code in exporter-trace-otlp-http (npm)
--- Credit: OpenSSF source...
CVE-2026-44967
A flaw was found in opentelemetry-cpp. The OTLP HTTP exporters traces/metrics/logs read the full HTTP response into an in-memory vector of bytes without a size cap. This can be exploited by an attacker-controlled collector endpoint or a network attacker performing a Man-in-the-Middle MITM attack...
Malicious code in opentelemetry-exporter-otlp-http (RubyGems)
--- -= Per source details. Do not edit below this line.=-...
MAL-2026-15763 Malicious code in opentelemetry-exporter-otlp-http (RubyGems)
--- -= Per source details. Do not edit below this line.=-...
AZL-90080 CVE-2026-44967 affecting package opentelemetry-cpp for versions less than 1.14.2-3
OpenTelemetry-cpp is the C++ implementation of OpenTelemetry. Prior to release 1.27.0, the OTLP HTTP exporters traces/metrics/logs read the full HTTP response into an in-memory vector of bytes without a size cap. This is exploitable for memory exhaustion when the configured collector endpoint is...
CVE-2026-44967
OpenTelemetry-cpp is the C++ implementation of OpenTelemetry. Prior to release 1.27.0, the OTLP HTTP exporters traces/metrics/logs read the full HTTP response into an in-memory vector of bytes without a size cap. This is exploitable for memory exhaustion when the configured collector endpoint is...
CVE-2026-44967: Memory Allocation with Excessive Size Value
OpenTelemetry-cpp is the C++ implementation of OpenTelemetry. Prior to release 1.27.0, the OTLP HTTP exporters traces/metrics/logs read the full HTTP response into an in-memory vector of bytes without a size cap. This is exploitable for memory exhaustion when the configured collector endpoint is...
AZL-82112 CVE-2026-39882 affecting package azurelinux-image-tools for versions less than 1.3.0-1
OpenTelemetry-Go is the Go implementation of OpenTelemetry. Prior to 1.43.0, the otlp HTTP exporters traces/metrics/logs read the full HTTP response body into an in-memory bytes.Buffer without a size cap. This is exploitable for memory exhaustion when the configured collector endpoint is...
AZL-82461 CVE-2026-39882 affecting package moby-engine for versions less than 25.0.3-17
OpenTelemetry-Go is the Go implementation of OpenTelemetry. Prior to 1.43.0, the otlp HTTP exporters traces/metrics/logs read the full HTTP response body into an in-memory bytes.Buffer without a size cap. This is exploitable for memory exhaustion when the configured collector endpoint is...
AZL-82190 CVE-2026-39882 affecting package docker-buildx for versions less than 0.14.0-11
OpenTelemetry-Go is the Go implementation of OpenTelemetry. Prior to 1.43.0, the otlp HTTP exporters traces/metrics/logs read the full HTTP response body into an in-memory bytes.Buffer without a size cap. This is exploitable for memory exhaustion when the configured collector endpoint is...
CVE-2026-39882 OpenTelemetry-Go OTLP HTTP exporters read unbounded HTTP response bodies
OpenTelemetry-Go is the Go implementation of OpenTelemetry. Prior to 1.43.0, the otlp HTTP exporters traces/metrics/logs read the full HTTP response body into an in-memory bytes.Buffer without a size cap. This is exploitable for memory exhaustion when the configured collector endpoint is...
CVE-2026-39882
OpenTelemetry-Go is the Go implementation of OpenTelemetry. Prior to 1.43.0, the otlp HTTP exporters traces/metrics/logs read the full HTTP response body into an in-memory bytes.Buffer without a size cap. This is exploitable for memory exhaustion when the configured collector endpoint is...
CVE-2026-39882: Memory Allocation with Excessive Size Value
OpenTelemetry-Go is the Go implementation of OpenTelemetry. Prior to 1.43.0, the otlp HTTP exporters traces/metrics/logs read the full HTTP response body into an in-memory bytes.Buffer without a size cap. This is exploitable for memory exhaustion when the configured collector endpoint is...