5.9
Medium
CVE-2026-42348 OpenTelemetry.OpAmp.Client is the OpAMP client for OpenTelemetry .NET
Description
OpenTelemetry.OpAmp.Client is the OpAMP client for OpenTelemetry .NET. Prior to 0.2.0-alpha.1, when receiving responses from the OpAMP server over HTTP, the OpAMP client allocates an unbounded buffer to read all bytes from the server, with no upper-bound on the number of bytes consumed. This could cause memory exhaustion in the consuming application if the configured OpAMP server is attacker-controlled (or a network attacker can MitM the connection) and an extremely large body is returned in the response. This vulnerability is fixed in 0.2.0-alpha.1.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| opentelemetry-dotnet-contrib 0.2 | earliest → < 0.2.0-alpha.1 | 0.2.0-alpha.1 |
Other CVEs of opentelemetry-dotnet-contrib
The 6 CVEs of opentelemetry-dotnet-contrib →
CVE-2026-81192
`OpenTelemetry.Resources.Host` NuGet package, which provides OpenTelemetry resource detectors for host, is affected by…
7.0
High
CVE-2026-44213
The OpenTelemetry.Exporter.Instana exports telemetry to Instana backend
6.5
Medium
CVE-2026-41484
OpenTelemetry.Exporter.OneCollector is a .NET exporter that sends telemetry to a OneCollector back-end over HTTP
5.3
Medium
CVE-2026-41483
OpenTelemetry.Resources.Azure is the .NET resource detector for Azure environments
5.9
Medium