The vulnerability of the confighttp and configgrpc modules in the data processing software for OpenTelemetry Collector allows a attacker to cause a service failure.

The vulnerability of the confighttp and configgrpc modules in the OpenTelemetry Collector data processing software arises from memory exhaustion resulting from operations exceeding the buffer limits. Exploiting this vulnerability allows a malicious actor to cause service failures by sending...

CVE-2024-36129

A flaw was found in OpenTelemetry Collector. When sending an HTTP or gRPC request with a compressed payload, the Collector only verifies whether the compressed payload is beyond a certain limit but not its uncompressed version. This flaw allows an attacker using a specially crafted HTTP or gRPC...

CVE-2024-36129

The OpenTelemetry Collector offers a vendor-agnostic implementation on how to receive, process and export telemetry data. An unsafe decompression vulnerability allows unauthenticated attackers to crash the collector via excessive memory consumption. OTel Collector version 0.102.1 fixes this issue...

CVE-2024-36129 OpenTelemetry Collector has a Denial of Service via Zip/Decompression Bomb sent over HTTP or gRPC

The OpenTelemetry Collector offers a vendor-agnostic implementation on how to receive, process and export telemetry data. An unsafe decompression vulnerability allows unauthenticated attackers to crash the collector via excessive memory consumption. OTel Collector version 0.102.1 fixes this issue...