com.digitalpebble.stormcrawler:storm-crawler-aws (2.0), com.digitalpebble.stormcrawler:storm-crawler-core (2.0) +49 more potentially affected by CVE-2026-45292 via io.opentelemetry:opentelemetry-api (0.4.0)

io.opentelemetry:opentelemetry-api MAVEN version 0.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on io.opentelemetry:opentelemetry-api and may be impacted: - com.digitalpebble.stormcrawler:storm-crawler-aws 2.0 -...

opentelemetry-go: OTLP HTTP exporters read unbounded HTTP response bodies

overview: this report shows that the otlp HTTP exporters traces/metrics/logs read the full HTTP response body into an in-memory bytes.Buffer without a size cap. this is exploitable for memory exhaustion when the configured collector endpoint is attacker-controlled or a network attacker can mitm t...