Open-telemetry vulnerabilities
62 CVEs and advisories name Open-telemetry as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-45676OpenTelemetry eBPF Instrumentation: Unsafe fastelf parsing allows malformed ELF to crash agent
- CVE-2026-45682OpenTelemetry eBPF Instrumentation: CappedConcurrentHashMap leaks keys after removals
- CVE-2026-45292opentelemetry-java: Unbounded Memory Allocation in W3C Baggage Propagation
- CVE-2026-44902opentelemetry-js: Prometheus exporter process crash via malformed HTTP request
- CVE-2026-44213OpenTelemetry.Exporter.Instana bypasses TLS certificate validation when a proxy is configured
- CVE-2026-42602azureauthextension Authenticate method does not validate bearer tokens, allowing auth bypass via replay
- CVE-2026-42191OpenTelemetry.Exporter.OpenTelemetryProtocol: Disk retry default temp path enables local blob injection for OTLP Exporter
- CVE-2026-42348OpAMP client reads unbounded HTTP response bodies
- CVE-2026-41484OpenTelemetry.Exporter.OneCollector vulnerable to denial of service via unbounded HTTP error response body
- CVE-2026-41483Unbounded HTTP response body read in OpenTelemetry.Resources.Azure
- CVE-2026-41310OpenTelemetry .NET Zipkin exporter has unbounded remote endpoint cache leading to memory growth
- CVE-2026-41433OpenTelemetry eBPF Instrumentation: Privileged Java agent injection allows arbitrary host file overwrite via untrusted TMPDIR
- CVE-2026-41173Unbounded HTTP response body read in OpenTelemetry.Sampler.AWS
- CVE-2026-41078OpenTelemetry dotnet: Potential memory exhaustion via unbounded pooled-list sizing in Jaeger exporter conversion path
- CVE-2026-40894OpenTelemetry dotnet: Excessive memory allocation when parsing OpenTelemetry propagation headers
- CVE-2026-40891OpenTelemetry dotnet: Unbounded `grpc-status-details-bin` parsing in OTLP/gRPC retry handling
- CVE-2026-40182OpenTelemetry dotnet: OTLP exporter reads unbounded HTTP response bodies
- CVE-2026-39883OpenTelemetry-Go has an incomplete fix for CVE-2026-24051: BSD kenv command not using absolute path enables PATH hijacking
- CVE-2026-39882OpenTelemetry-Go OTLP HTTP exporters read unbounded HTTP response bodies
- CVE-2026-29181OpenTelemetry-Go multi-value `baggage` header extraction causes excessive allocations (remote dos amplification)
- CVE-2026-33701OpenTelemetry: Unsafe Deserialization in RMI Instrumentation may Lead to Remote Code Execution
- CVE-2026-24051OpenTelemetry-Go Affected by Arbitrary Code Execution via PATH Hijacking
- CVE-2025-27513OpenTelemetry .NET has a Denial of Service (DoS) Vulnerability in API Package
- CVE-2024-45043OpenTelemetry Collector AWS Firehose Receiver Authentication Bypass Vulnerability
- CVE-2024-42368open-telemetry has an Observable Timing Discrepancy
- CVE-2024-36129OpenTelemetry Collector has a Denial of Service via Zip/Decompression Bomb sent over HTTP or gRPC
- CVE-2024-32028Sensitive query parameters logged by default in OpenTelemetry.Instrumentation http and AspNetCore
- CVE-2023-47108DoS vulnerability in otelgrpc (uncontrolled resource consumption) due to unbound cardinality metrics
- CVE-2023-45142OpenTelemetry-Go Contrib has DoS vulnerability in otelhttp due to unbound cardinality metrics
- CVE-2023-43810opentelemetry-instrumentation Denial of Service vulnerability due to unbound cardinality metrics