CVE-2023-45142

OpenTelemetry-Go Contrib is a collection of third-party packages for OpenTelemetry-Go. A handler wrapper out of the box adds labels http.useragent and http.method that have unbound cardinality. It leads to the server's potential memory exhaustion when many malicious requests are sent to it. HTTP...

CVE-2023-45142

CVE-2023-45142 affects OpenTelemetry-Go Contrib when using the otelhttp.NewHandler wrapper without filtering; the handler logs every HTTP method and User-Agent via httpconv.ServerRequest, enabling unbounded cardinality and potential memory exhaustion under many malicious requests. The root cause ...

CVE-2023-45142

OpenTelemetry-Go Contrib is a collection of third-party packages for OpenTelemetry-Go. A handler wrapper out of the box adds labels "http.useragent" and "http.method" that have unbound cardinality. It leads to the server's potential memory exhaustion when many malicious requests are sent to it...

CVE-2023-45142 OpenTelemetry-Go Contrib has DoS vulnerability in otelhttp due to unbound cardinality metrics

OpenTelemetry-Go Contrib is a collection of third-party packages for OpenTelemetry-Go. A handler wrapper out of the box adds labels http.useragent and http.method that have unbound cardinality. It leads to the server's potential memory exhaustion when many malicious requests are sent to it. HTTP...

OpenTelemetry-Go Contrib Security Vulnerability

OpenTelemetry-Go Contrib is a collection of OpenTelemetry Go extensions open-sourced by OpenTelemetry. A security vulnerability exists in OpenTelemetry-Go Contrib that stems from a potential server memory exhaustion when a large number of malicious requests are sent to the server...

CVE-2023-45142: Allocation of Resources Without Limits or Throttling

OpenTelemetry-Go Contrib is a collection of third-party packages for OpenTelemetry-Go. A handler wrapper out of the box adds labels http.useragent and http.method that have unbound cardinality. It leads to the server's potential memory exhaustion when many malicious requests are sent to it. HTTP...

Denial Of Service (DoS)

OpenTelemetry is vulnerable to Denial Of Service. The vulnerability is due to the httpmethod not being properly bounded, resulting in the potential for server memory exhaustion when a large number of malicious requests are sent...

CVE-2023-43810

OpenTelemetry, also known as OTel for short, is a vendor-neutral open-source Observability framework for instrumenting, generating, collecting, and exporting telemetry data such as traces, metrics, logs. Autoinstrumentation out of the box adds the label httpmethod that has unbound cardinality. It...

Design/Logic Flaw

OpenTelemetry, also known as OTel for short, is a vendor-neutral open-source Observability framework for instrumenting, generating, collecting, and exporting telemetry data such as traces, metrics, logs. Autoinstrumentation out of the box adds the label httpmethod that has unbound cardinality. It...

CVE-2023-43810

CVE-2023-43810 concerns OpenTelemetry instrumentation. Autoinstrumentation may expose an unbounded http_method label, enabling memory exhaustion under large numbers of crafted requests. Affected if the application is instrumented for HTTP handlers and does not filter non-standard methods at CDN/L...

CVE-2023-43810

OpenTelemetry, also known as OTel for short, is a vendor-neutral open-source Observability framework for instrumenting, generating, collecting, and exporting telemetry data such as traces, metrics, logs. Autoinstrumentation out of the box adds the label "httpmethod" that has unbound cardinality. ...

azure-monitor-opentelemetry (>=1.0.0b9, <=1.0.0b16), azure-monitor-opentelemetry-distro (>=1.0.0b6, <=1.0.0b7) +125 more potentially affected by CVE-2023-43810 via opentelemetry-instrumentation (>=0.12.0b0, <=0.40.0b0)

opentelemetry-instrumentation PYPI version =0.12.0b0, =1.0.0b9, =1.0.0b6, =0.0.15b0, =1.0.0a3, =1.0.1, =0.1.0, =0.2.0, =0.6.0, =1.0.0, =0.0.1a40, =0.1.0, =0.10.7, =0.2.0, =0.3.3 and more Source cves: CVE-2023-43810 Source advisory: MEND:CVE-2023-43810...

CVE-2023-43810 opentelemetry-instrumentation Denial of Service vulnerability due to unbound cardinality metrics

OpenTelemetry, also known as OTel for short, is a vendor-neutral open-source Observability framework for instrumenting, generating, collecting, and exporting telemetry data such as traces, metrics, logs. Autoinstrumentation out of the box adds the label httpmethod that has unbound cardinality. It...

CVE-2023-43810 opentelemetry-instrumentation Denial of Service vulnerability due to unbound cardinality metrics

OpenTelemetry, also known as OTel for short, is a vendor-neutral open-source Observability framework for instrumenting, generating, collecting, and exporting telemetry data such as traces, metrics, logs. Autoinstrumentation out of the box adds the label httpmethod that has unbound cardinality. It...

CVE-2023-43810 opentelemetry-instrumentation Denial of Service vulnerability due to unbound cardinality metrics

OpenTelemetry, also known as OTel for short, is a vendor-neutral open-source Observability framework for instrumenting, generating, collecting, and exporting telemetry data such as traces, metrics, logs. Autoinstrumentation out of the box adds the label httpmethod that has unbound cardinality. It...

CVE-2023-43810: Uncontrolled Resource Consumption

OpenTelemetry, also known as OTel for short, is a vendor-neutral open-source Observability framework for instrumenting, generating, collecting, and exporting telemetry data such as traces, metrics, logs. Autoinstrumentation out of the box adds the label httpmethod that has unbound cardinality. It...

opentelemetry-instrumentation Denial of Service vulnerability due to unbound cardinality metrics

Summary Autoinstrumentation out of the box adds the label httpmethod that has unbound cardinality. It leads to the server's potential memory exhaustion when many malicious requests are sent. Details HTTP method for requests can be easily set by an attacker to be random and long. PoC Send many...

azure-monitor-opentelemetry (>=1.0.0b9, <=1.0.0b16), azure-monitor-opentelemetry-distro (>=1.0.0b6, <=1.0.0b7) +125 more potentially affected by CVE-2023-43810 via opentelemetry-instrumentation (>=0.12.0b0, <=0.40.0b0)

opentelemetry-instrumentation PYPI version =0.12.0b0, =1.0.0b9, =1.0.0b6, =0.0.15b0, =1.0.0a3, =1.0.1, =0.1.0, =0.2.0, =0.6.0, =1.0.0, =0.0.1a40, =0.1.0, =0.10.7, =0.2.0, =0.3.3 and more Source cves: CVE-2023-43810 Source advisory: GHSA-5RV5-6H4R-H22V...

azure-monitor-opentelemetry (>=1.0.0b9, <=1.0.0b16), azure-monitor-opentelemetry-distro (>=1.0.0b6, <=1.0.0b7) +125 more potentially affected by CVE-2023-43810 via opentelemetry-instrumentation (>=0.12.0b0, <=0.40.0b0)

opentelemetry-instrumentation PYPI version =0.12.0b0, =1.0.0b9, =1.0.0b6, =0.0.15b0, =1.0.0a3, =1.0.1, =0.1.0, =0.2.0, =0.6.0, =1.0.0, =0.0.1a40, =0.1.0, =0.10.7, =0.2.0, =0.3.3 and more Source cves: CVE-2023-43810 Source advisory: OSV:GHSA-5RV5-6H4R-H22V...

PT-2023-28999

Name of the Vulnerable Software and Affected Versions OpenTelemetry versions prior to 0.41b0 Description OpenTelemetry is a vendor-neutral open-source Observability framework for instrumenting, generating, collecting, and exporting telemetry data. The autoinstrumentation feature adds the label ht...