CVE-2024-36129 OpenTelemetry Collector has a Denial of Service via Zip/Decompression Bomb sent over HTTP or gRPC

The OpenTelemetry Collector offers a vendor-agnostic implementation on how to receive, process and export telemetry data. An unsafe decompression vulnerability allows unauthenticated attackers to crash the collector via excessive memory consumption. OTel Collector version 0.102.1 fixes this issue...

Denial of Service via Zip/Decompression Bomb sent over HTTP or gRPC

Summary An unsafe decompression vulnerability allows unauthenticated attackers to crash the collector via excessive memory consumption. Details The OpenTelemetry Collector handles compressed HTTP requests by recognizing the Content-Encoding header, rewriting the HTTP request body, and allowing...

OpenTelemetry Collector Buffer Error Vulnerability

OpenTelemetry Collector is a software from the OpenTelemetry project for receiving, processing, and exporting telemetry data. A security vulnerability exists in OpenTelemetry Collector that stems from the presence of an insecure unpacking vulnerability that allows an unauthenticated attacker to...

PT-2024-4606

Name of the Vulnerable Software and Affected Versions: OpenTelemetry Collector versions prior to 0.102.1 confighttp module versions prior to 0.102.0 configgrpc module versions prior to 0.102.1 Description: An unsafe decompression vulnerability allows unauthenticated attackers to crash the collect...

GHSA-2CGQ-H8XW-2V5J vulnerabilities

Vulnerabilities for packages: neuvector-scanner, cadvisor-fips, opentelemetry-collector-contrib-fips, wolfictl, ctop, kubernetes, buildah, opentelemetry-collector-contrib, grype, cadvisor...

CVE-2024-3154 vulnerabilities

Vulnerabilities for packages: neuvector-scanner, cadvisor-fips, opentelemetry-collector-contrib-fips, wolfictl, ctop, kubernetes, buildah, opentelemetry-collector-contrib, grype, cadvisor...