5.9
Moyenne
CVE-2026-42348 OpenTelemetry.OpAmp.Client is the OpAMP client for OpenTelemetry .NET
Description
OpenTelemetry.OpAmp.Client is the OpAMP client for OpenTelemetry .NET. Prior to 0.2.0-alpha.1, when receiving responses from the OpAMP server over HTTP, the OpAMP client allocates an unbounded buffer to read all bytes from the server, with no upper-bound on the number of bytes consumed. This could cause memory exhaustion in the consuming application if the configured OpAMP server is attacker-controlled (or a network attacker can MitM the connection) and an extremely large body is returned in the response. This vulnerability is fixed in 0.2.0-alpha.1.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| opentelemetry-dotnet-contrib 0.2 | premières → < 0.2.0-alpha.1 | 0.2.0-alpha.1 |
Autres CVE de opentelemetry-dotnet-contrib
Les 6 CVE de opentelemetry-dotnet-contrib →
CVE-2026-81192
`OpenTelemetry.Resources.Host` NuGet package, which provides OpenTelemetry resource detectors for host, is affected by…
7.0
Élevée
CVE-2026-44213
The OpenTelemetry.Exporter.Instana exports telemetry to Instana backend
6.5
Moyenne
CVE-2026-41484
OpenTelemetry.Exporter.OneCollector is a .NET exporter that sends telemetry to a OneCollector back-end over HTTP
5.3
Moyenne
CVE-2026-41483
OpenTelemetry.Resources.Azure is the .NET resource detector for Azure environments
5.9
Moyenne