{"id":"CVE-2026-44967","aliases":["AZL-90080","BELL-CVE-2026-44967","DEBIAN-CVE-2026-44967","EUVD-2026-36466","UBUNTU-CVE-2026-44967"],"status":"published","title":"opentelemetry-cpp: OTLP HTTP exporters read unbounded HTTP response","description":"OpenTelemetry-cpp is the C++ implementation of OpenTelemetry. Prior to release 1.27.0, the OTLP HTTP exporters (traces/metrics/logs) read the full HTTP response into an in-memory vector of bytes without a size cap. This is exploitable for memory exhaustion when the configured collector endpoint is attacker-controlled (or a network attacker can MITM the exporter connection). This vulnerability is fixed in opentelemetry-cpp release 1.27.0.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00206,"percentile":0.10738,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-789"],"published":"2026-06-12T14:52:00Z","modified":"2026-11-05T05:40:51Z","fixes":[{"ecosystem":"Azure Linux:3","package":"opentelemetry-cpp","fixed_in":["1.14.2-3"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"opentelemetry-cpp","fixed_in":["1.28.0-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Azure Linux:3","package":"opentelemetry-cpp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.2-3"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"opentelemetry-cpp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.19.0-3","1.23.0-1","1.23.0-2","1.23.0-3","1.28.0-1","1.28.0-2"]},{"source":"osv","ecosystem":"Debian:14","package":"opentelemetry-cpp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.28.0-1"}]}],"versions":["1.19.0-3","1.23.0-1","1.23.0-2","1.23.0-3"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"opentelemetry-cpp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.17.0-3ubuntu1","1.19.0-3"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"opentelemetry-cpp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.23.0-3build1","1.23.0-3build2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"opentelemetry-cpp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.19.0-3","1.23.0-2","1.23.0-3","1.23.0-3build1"]}],"products":[{"vendor":"open-telemetry","product":"opentelemetry-cpp"},{"vendor":"opentelemetry","product":"opentelemetry"}],"references":[{"url":"https://github.com/open-telemetry/opentelemetry-cpp/security/advisories/GHSA-5qhm-4rfp-qqvj","tags":["x_refsource_CONFIRM","Vendor Advisory","advisory","report"]},{"url":"https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-w8rr-5gcm-pp58","tags":["x_refsource_MISC","exploit","Not Applicable","Vendor Advisory","advisory","report"]},{"url":"https://github.com/open-telemetry/opentelemetry-cpp/issues/3958","tags":["x_refsource_MISC","Issue Tracking","report"]},{"url":"https://github.com/open-telemetry/opentelemetry-cpp/pull/4078","tags":["x_refsource_MISC","Issue Tracking","fix","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-44967","tags":["web","advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2026-44967","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/44xxx/CVE-2026-44967.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-44967","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-44967","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-44967","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-44967","title":"opentelemetry-cpp: OTLP HTTP exporters read unbounded HTTP response","description":"OpenTelemetry-cpp is the C++ implementation of OpenTelemetry. Prior to release 1.27.0, the OTLP HTTP exporters (traces/metrics/logs) read the full HTTP response into an in-memory vector of bytes without a size cap. This is exploitable for memory exhaustion when the configured collector endpoint is attacker-controlled (or a network attacker can MITM the exporter connection). This vulnerability is fixed in opentelemetry-cpp release 1.27.0.","status":"published","published":"2026-06-12T14:52:00.124Z","modified":"2026-06-12T16:10:48.362Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"cna"}],"cwes":["CWE-789"],"updated_at":"2026-11-02T13:42:49.132798Z"}],"euvd":[{"id":"EUVD-2026-36466","description":"OpenTelemetry-cpp is the C++ implementation of OpenTelemetry. Prior to release 1.27.0, the OTLP HTTP exporters (traces/metrics/logs) read the full HTTP response into an in-memory vector of bytes without a size cap. This is exploitable for memory exhaustion when the configured collector endpoint is attacker-controlled (or a network attacker can MITM the exporter connection). This vulnerability is fixed in opentelemetry-cpp release 1.27.0.","status":"published","published":"2026-06-12T14:52:00Z","modified":"2026-06-12T16:10:48Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T18:20:43.222Z"}],"nvd":[{"id":"CVE-2026-44967","description":"OpenTelemetry-cpp is the C++ implementation of OpenTelemetry. Prior to release 1.27.0, the OTLP HTTP exporters (traces/metrics/logs) read the full HTTP response into an in-memory vector of bytes without a size cap. This is exploitable for memory exhaustion when the configured collector endpoint is attacker-controlled (or a network attacker can MITM the exporter connection). This vulnerability is fixed in opentelemetry-cpp release 1.27.0.","status":"published","published":"2026-06-12T16:16:27.973Z","modified":"2026-10-26T11:10:00.157Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"secondary"},{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary"}],"cwes":["CWE-789"],"updated_at":"2026-11-02T14:12:23.846948Z"}],"osv":[{"id":"BELL-CVE-2026-44967","title":"CVE-2026-44967 does not affect BellSoft software","status":"withdrawn","published":"2026-09-13T06:04:27.5783Z","modified":"2026-10-06T07:15:02.637202159Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:28:24.12174Z"},{"id":"CVE-2026-44967","title":"opentelemetry-cpp: OTLP HTTP exporters read unbounded HTTP response","description":"OpenTelemetry-cpp is the C++ implementation of OpenTelemetry. Prior to release 1.27.0, the OTLP HTTP exporters (traces/metrics/logs) read the full HTTP response into an in-memory vector of bytes without a size cap. This is exploitable for memory exhaustion when the configured collector endpoint is attacker-controlled (or a network attacker can MITM the exporter connection). This vulnerability is fixed in opentelemetry-cpp release 1.27.0.","status":"published","published":"2026-06-12T14:52:00.124Z","modified":"2026-10-28T11:16:49.17724903Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-789"],"updated_at":"2026-11-02T15:45:05.172514Z"},{"id":"DEBIAN-CVE-2026-44967","description":"OpenTelemetry-cpp is the C++ implementation of OpenTelemetry. Prior to release 1.27.0, the OTLP HTTP exporters (traces/metrics/logs) read the full HTTP response into an in-memory vector of bytes without a size cap. This is exploitable for memory exhaustion when the configured collector endpoint is attacker-controlled (or a network attacker can MITM the exporter connection). This vulnerability is fixed in opentelemetry-cpp release 1.27.0.","status":"published","published":"2026-06-12T16:16:27.973Z","modified":"2026-10-27T09:47:31.991880266Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:45:55.669088Z"},{"id":"UBUNTU-CVE-2026-44967","description":"OpenTelemetry-cpp is the C++ implementation of OpenTelemetry. Prior to release 1.27.0, the OTLP HTTP exporters (traces/metrics/logs) read the full HTTP response into an in-memory vector of bytes without a size cap. This is exploitable for memory exhaustion when the configured collector endpoint is attacker-controlled (or a network attacker can MITM the exporter connection). This vulnerability is fixed in opentelemetry-cpp release 1.27.0.","status":"published","published":"2026-06-12T16:16:00Z","modified":"2026-10-17T13:00:09.7595053Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"},{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T16:56:26.396868Z"},{"id":"AZL-90080","title":"CVE-2026-44967 affecting package opentelemetry-cpp for versions less than 1.14.2-3","description":"OpenTelemetry-cpp is the C++ implementation of OpenTelemetry. Prior to release 1.27.0, the OTLP HTTP exporters (traces/metrics/logs) read the full HTTP response into an in-memory vector of bytes without a size cap. This is exploitable for memory exhaustion when the configured collector endpoint is attacker-controlled (or a network attacker can MITM the exporter connection). This vulnerability is fixed in opentelemetry-cpp release 1.27.0.","status":"published","published":"2026-06-12T16:16:27Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:25.633663Z"}]}}