open-telemetry opentelemetry-cpp up to 1.26.x Collector Endpoint /metrics/logs memory allocation

Summaryinfo

A vulnerability was found in open-telemetry opentelemetry-cpp up to 1.26.x. It has been declared as problematic. Impacted is an unknown function of the file /metrics/logs of the component Collector Endpoint. Such manipulation leads to memory allocation. This vulnerability is listed as CVE-2026-44967. The attack must be carried out from within the local network. There is no available exploit. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability was found in open-telemetry opentelemetry-cpp up to 1.26.x. It has been rated as problematic. Affected by this issue is some unknown processing of the file /metrics/logs of the component Collector Endpoint. The manipulation with an unknown input leads to a memory allocation vulnerability. Using CWE to declare the problem leads to CWE-789. The product allocates memory based on an untrusted, large size value, but it does not ensure that the size is within expected limits, allowing arbitrary amounts of memory to be allocated. Impacted is availability. CVE summarizes:

OpenTelemetry-cpp is the C++ implementation of OpenTelemetry. Prior to release 1.27.0, the OTLP HTTP exporters (traces/metrics/logs) read the full HTTP response into an in-memory vector of bytes without a size cap. This is exploitable for memory exhaustion when the configured collector endpoint is attacker-controlled (or a network attacker can MITM the exporter connection). This vulnerability is fixed in opentelemetry-cpp release 1.27.0.

The advisory is shared for download at github.com. This vulnerability is handled as CVE-2026-44967 since 05/08/2026. The exploitation is known to be difficult. Access to the local network is required for this attack to succeed. No form of authentication is required for exploitation. There are known technical details, but no exploit is available.

Upgrading to version 1.27.0 eliminates this vulnerability. Applying a patch is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• open-telemetry

Name

• opentelemetry-cpp

Version

• 1.0
• 1.1
• 1.2
• 1.3
• 1.4
• 1.5
• 1.6
• 1.7
• 1.8
• 1.9
• 1.10
• 1.11
• 1.12
• 1.13
• 1.14
• 1.15
• 1.16
• 1.17
• 1.18
• 1.19
• 1.20
• 1.21
• 1.22
• 1.23
• 1.24
• 1.25
• 1.26

Website

• Product: https://github.com/open-telemetry/opentelemetry-cpp/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion