CVE-2026-44967 opentelemetry-cpp: OTLP HTTP exporters read unbounded HTTP response

OpenTelemetry-cpp is the C++ implementation of OpenTelemetry. Prior to release 1.27.0, the OTLP HTTP exporters traces/metrics/logs read the full HTTP response into an in-memory vector of bytes without a size cap. This is exploitable for memory exhaustion when the configured collector endpoint is...

CVE-2026-44967 opentelemetry-cpp: OTLP HTTP exporters read unbounded HTTP response

OpenTelemetry-cpp is the C++ implementation of OpenTelemetry. Prior to release 1.27.0, the OTLP HTTP exporters traces/metrics/logs read the full HTTP response into an in-memory vector of bytes without a size cap. This is exploitable for memory exhaustion when the configured collector endpoint is...

CVE-2026-44967

OpenTelemetry-cpp is the C++ implementation of OpenTelemetry. Prior to release 1.27.0, the OTLP HTTP exporters traces/metrics/logs read the full HTTP response into an in-memory vector of bytes without a size cap. This is exploitable for memory exhaustion when the configured collector endpoint is...

Important: Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: opentelemetry-collector-contrib: opentelemetry-collector-contrib-0.153.0-1.hum1 aarch64, x8664 opentelemetry-collector-contrib-0.153.0-1.hum1.src src...

GHSA-99F4-GRH7-6PCQ vulnerabilities

Vulnerabilities for packages: pulumi, gemini-cli, langfuse, langfuse-fips, cadence-web, opentelemetry-auto-instrumentations-node, jitsucom-jitsu, kibana...

GHSA-5375-PQ7M-F5R2 vulnerabilities

Vulnerabilities for packages: pulumi, gemini-cli, langfuse, langfuse-fips, cadence-web, opentelemetry-auto-instrumentations-node, jitsucom-jitsu, kibana...

CVE-2026-48069 vulnerabilities

Vulnerabilities for packages: pulumi, gemini-cli, langfuse, langfuse-fips, cadence-web, opentelemetry-auto-instrumentations-node, jitsucom-jitsu, kibana...

CVE-2026-48068 vulnerabilities

Vulnerabilities for packages: pulumi, gemini-cli, langfuse, langfuse-fips, cadence-web, opentelemetry-auto-instrumentations-node, jitsucom-jitsu, kibana...

PT-2026-48892

Name of the Vulnerable Software and Affected Versions OpenTelemetry-cpp versions prior to 1.27.0 Description The OTLP HTTP exporters for traces, metrics, and logs read the complete HTTP response into an in-memory vector of bytes without implementing a size limit. This can lead to memory exhaustio...

Linux Distros Unpatched Vulnerability : CVE-2026-44967

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - OpenTelemetry-cpp is the C++ implementation of OpenTelemetry. Prior to release 1.27.0, the OTLP HTTP exporters traces/metrics/logs read the full HTTP response...

Important: Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: opentelemetry-collector: opentelemetry-collector-0.153.0-1.hum1 aarch64, x8664 opentelemetry-collector-0.153.0-1.hum1.src src...

go.opentelemetry.io/otel: go.opentelemetry.io/otel/schema/v1.0: go.opentelemetry.io/otel/schema/v1.1: OpenTelemetry-Go: Denial of Service due to file descriptor leak

A flaw was found in OpenTelemetry-Go before schema package version 0.0.17. ParseFile in go.opentelemetry.io/otel/schema/v1.0 and v1.1 opens a schema file and passes it to Parse without closing it, leaking one file descriptor per successful call. Repeated parsing in a long-running process can...

go.opentelemetry.io/otel: go.opentelemetry.io/otel/schema/v1.0: go.opentelemetry.io/otel/schema/v1.1: OpenTelemetry-Go: Denial of Service due to file descriptor leak

A flaw was found in OpenTelemetry-Go before schema package version 0.0.17. ParseFile in go.opentelemetry.io/otel/schema/v1.0 and v1.1 opens a schema file and passes it to Parse without closing it, leaking one file descriptor per successful call. Repeated parsing in a long-running process can...

GHSA-CXH2-4639-VMC5 OpenTelemetry Operator for Kubernetes's ServiceMonitor bearerTokenFile reads arbitrary local file and sends contents as bearer auth

Affected Repository: github.com/open-telemetry/opentelemetry-operator Component: cmd/otel-allocator TargetAllocator Companion: Prometheus Operator API types CRDs Summary OpenTelemetry Operator's TargetAllocator watches ServiceMonitor resources via the Prometheus Operator CR watcher and converts...

CLEANSTART-2026-MC76610 Security fixes for CVE-2026-27145, CVE-2026-33816, CVE-2026-34986, CVE-2026-39821, CVE-2026-39824, CVE-2026-39883, CVE-2026-41602, CVE-2026-42504, CVE-2026-42507, CVE-2026-46595, ghsa-6g7g-w4f8-9c9x, ghsa-p77j-4mvh-x3m3, ghsa-xmrv-pmrh-hhx2 applied in versions: 0.144.0-r3, 0.144.0-r4, 0.150.0-r0, 0.150.0-r1

Multiple security vulnerabilities affect the opentelemetry-collector-contrib package. These issues are resolved in later releases. See references for individual vulnerability details...

CVE-2026-44902

A flaw was found in opentelemetry-js, specifically within the OpenTelemetry JavaScript JS Prometheus exporter. A remote attacker could exploit this vulnerability by sending a single malformed HTTP request to the metrics endpoint. This lack of proper error handling during URL parsing can cause an...

CVE-2026-45683

OpenTelemetry eBPF Instrumentation provides eBPF instrumentation based on the OpenTelemetry standard. Prior to version 0.9.0, the Java TLS ioctl probe reads user-controlled ioctl pointers with bpfproberead instead of bpfprobereaduser. An instrumented local process can therefore point OBI at kerne...

CVE-2026-41310

OpenTelemetry.Exporter.Zipkin is the .NET Zipkin exporter for OpenTelemetry. In versions 1.15.2 and earlier, the Zipkin exporter remote endpoint cache accepts unbounded key growth derived from span attributes. In high-cardinality scenarios, a process using Zipkin export for client or producer spa...

CVE-2026-41483

OpenTelemetry.Resources.Azure is the .NET resource detector for Azure environments. In versions 1.15.0-beta.1 and earlier, the AzureVmMetaDataRequestor class makes HTTP requests to the Azure VM instance metadata service and reads the response body into memory without any size limit. An attacker w...

CVE-2026-41078

OpenTelemetry dotnet is a dotnet telemetry framework. In 1.6.0-rc.1 and earlier, OpenTelemetry.Exporter.Jaeger may allow sustained memory pressure when the internal pooled-list sizing grows based on a large observed span/tag set and that enlarged size is reused for subsequent allocations. Under...