Skip to content

Opentelemetry Opentelemetry vulnerabilities

opentelemetry opentelemetry-exporter-otlp-proto-http OpenTelemetry opentelemetry-exporter-otlp-proto-http 1.5.0 before 1.45.0 Improper Certificate Validation CVE-2026-112006 Fix available 8.3 HighOctober 18, 2026
open-telemetry opentelemetry-js, opentelemetry +1 more opentelemetry-js: Unbounded memory allocation in W3C Baggage propagation CVE-2026-54285 Fix available 5.3 MediumJune 15, 2026
open-telemetry opentelemetry-cpp, opentelemetry +1 more opentelemetry-cpp: OTLP HTTP exporters read unbounded HTTP response CVE-2026-44967 Fix available 5.3 MediumJune 12, 2026
opentelemetry, open-telemetry go.opentelemetry.io/otel/baggage, go.opentelemetry.io/otel/propagation +2 more OpenTelemetry-Go's baggage parsing no longer caps raw header length CVE-2026-41178 Fix available 5.3 MediumMay 28, 2026
open-telemetry opentelemetry-js, @opentelemetry auto-instrumentations-node, exporter-prometheus +4 more +6 more opentelemetry-js: Prometheus exporter process crash via malformed HTTP request CVE-2026-44902 Fix available 7.5 HighMay 11, 2026
open-telemetry opentelemetry-collector-contrib, opentelemetry collector contrib +1 more azureauthextension Authenticate method does not validate bearer tokens, allowing auth bypass via replay CVE-2026-42602 Fix available 8.1 HighMay 6, 2026
opentelemetry opentelemetry.opamp.client, open-telemetry opentelemetry-dotnet-contrib +1 more OpAMP client reads unbounded HTTP response bodies CVE-2026-42348 Fix available 5.9 MediumMay 5, 2026
opentelemetry opentelemetry.exporter.opentelemetryprotocol, open-telemetry opentelemetry-dotnet +1 more OpenTelemetry.Exporter.OpenTelemetryProtocol: Disk retry default temp path enables local blob injection for OTLP Exporter CVE-2026-42191 Fix available 6.5 MediumApril 30, 2026
opentelemetry opentelemetry.exporter.onecollector, open-telemetry opentelemetry-dotnet-contrib +1 more OpenTelemetry.Exporter.OneCollector vulnerable to denial of service via unbounded HTTP error response body CVE-2026-41484 Fix available 5.3 MediumApril 29, 2026
opentelemetry opentelemetry.resources.azure, open-telemetry opentelemetry-dotnet-contrib +1 more Unbounded HTTP response body read in OpenTelemetry.Resources.Azure CVE-2026-41483 Fix available 5.9 MediumApril 29, 2026
opentelemetry opentelemetry.exporter.zipkin, open-telemetry opentelemetry-dotnet +1 more OpenTelemetry .NET Zipkin exporter has unbounded remote endpoint cache leading to memory growth CVE-2026-41310 Fix available 5.3 MediumApril 28, 2026
open-telemetry opentelemetry.api, opentelemetry.extensions.propagators, opentelemetry +1 more +3 more OpenTelemetry dotnet: Excessive memory allocation when parsing OpenTelemetry propagation headers CVE-2026-40894 Fix available 5.3 MediumApril 23, 2026
opentelemetry, open-telemetry opentelemetry-dotnet, opentelemetry.exporter.opentelemetryprotocol +2 more OpenTelemetry dotnet: Unbounded `grpc-status-details-bin` parsing in OTLP/gRPC retry handling CVE-2026-40891 Fix available 5.3 MediumApril 23, 2026
opentelemetry, open-telemetry opentelemetry-dotnet +1 more OpenTelemetry dotnet: OTLP exporter reads unbounded HTTP response bodies CVE-2026-40182 Fix available 5.3 MediumApril 23, 2026
open-telemetry opentelemetry.exporter.jaeger, opentelemetry, open-telemetry opentelemetry-dotnet +2 more OpenTelemetry dotnet: Potential memory exhaustion via unbounded pooled-list sizing in Jaeger exporter conversion path CVE-2026-41078 5.9 MediumApril 18, 2026
opentelemetry ebpf instrumentation, open-telemetry opentelemetry-ebpf-instrumentation +1 more OpenTelemetry eBPF Instrumentation: Privileged Java agent injection allows arbitrary host file overwrite via untrusted TMPDIR CVE-2026-41433 Fix available 8.4 HighApril 17, 2026
open-telemetry opentelemetry-go, opentelemetry, red hat cert manager support for red hat openshift release 1.19 +4 more +6 more OpenTelemetry-Go has an incomplete fix for CVE-2026-24051: BSD kenv command not using absolute path enables PATH hijacking CVE-2026-39883 Public exploitFix available 7.3 HighApril 8, 2026
open-telemetry opentelemetry-go, opentelemetry +1 more OpenTelemetry-Go OTLP HTTP exporters read unbounded HTTP response bodies CVE-2026-39882 Fix available 5.3 MediumApril 8, 2026
open-telemetry opentelemetry-go, opentelemetry, red hat cert manager support for red hat openshift release 1.19 +7 more +9 more OpenTelemetry-Go multi-value `baggage` header extraction causes excessive allocations (remote dos amplification) CVE-2026-29181 Fix available 7.5 HighApril 7, 2026
open-telemetry opentelemetry-go, opentelemetry +1 more OpenTelemetry-Go Affected by Arbitrary Code Execution via PATH Hijacking CVE-2026-24051 Fix available 7.0 HighFebruary 2, 2026
open-telemetry opentelemetry-collector-contrib, opentelemetry collector contrib +1 more OpenTelemetry Collector AWS Firehose Receiver Authentication Bypass Vulnerability CVE-2024-45043 Fix available 5.3 MediumAugust 28, 2024
open-telemetry opentelemetry-collector-contrib, opentelemetry collector contrib +1 more open-telemetry has an Observable Timing Discrepancy CVE-2024-42368 Fix available 6.5 MediumAugust 13, 2024
opentelemetry configgrpc, confighttp, opentelemetry +2 more +4 more OpenTelemetry Collector has a Denial of Service via Zip/Decompression Bomb sent over HTTP or gRPC CVE-2024-36129 Fix available 8.2 HighJune 5, 2024
opentelemetry, open-telemetry opentelemetry-dotnet +1 more Sensitive query parameters logged by default in OpenTelemetry.Instrumentation http and AspNetCore CVE-2024-32028 Fix available 4.1 MediumApril 12, 2024
opentelemetry, open-telemetry opentelemetry-go-contrib +1 more DoS vulnerability in otelgrpc (uncontrolled resource consumption) due to unbound cardinality metrics CVE-2023-47108 Public exploitFix available 7.5 HighNovember 10, 2023
opentelemetry, open-telemetry opentelemetry-go-contrib +1 more OpenTelemetry-Go Contrib has DoS vulnerability in otelhttp due to unbound cardinality metrics CVE-2023-45142 Fix available 7.5 HighOctober 12, 2023
opentelemetry, open-telemetry opentelemetry-python-contrib +1 more opentelemetry-instrumentation Denial of Service vulnerability due to unbound cardinality metrics CVE-2023-43810 Fix available 7.5 HighOctober 2, 2023
linuxfoundation opentelemetry instrumentation for java, open-telemetry opentelemetry-java-instrumentation +1 more Instrumentation for AWS SDK v2 captures email content when using Amazon Simple Email Service (SES) v1 API, exposing that content to the telemetry backend CVE-2023-39951 6.5 MediumAugust 8, 2023