CVE-2026-42348

OpenTelemetry.OpAmp.Client is the OpAMP client for OpenTelemetry .NET. Prior to 0.2.0-alpha.1, when receiving responses from the OpAMP server over HTTP, the OpAMP client allocates an unbounded buffer to read all bytes from the server, with no upper-bound on the number of bytes consumed. This could cause memory exhaustion in the consuming application if the configured OpAMP server is attacker-controlled (or a network attacker can MitM the connection) and an extremely large body is returned in the response. This vulnerability is fixed in 0.2.0-alpha.1.

CVSS v3 5.9 MEDIUM

5.9^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.2 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/open-telemetry/opentelemetry-dotnet-contrib/pull/4116	Issue Tracking
https://github.com/open-telemetry/opentelemetry-dotnet-contrib/security/advisories/GHSA-w2jh-77fq-7gp8	Patch Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:opentelemetry:opentelemetry.opamp.client:*:*:*:*:*:.net:*:*

History

26 Oct 2026, 18:10

Type	Values Removed	Values Added
Summary		(es) OpenTelemetry.OpAmp.Client es el cliente OpAMP para OpenTelemetry .NET. Antes de 0.2.0-alpha.1, al recibir respuestas del servidor OpAMP a través de HTTP, el cliente OpAMP asigna un búfer ilimitado para leer todos los bytes del servidor, sin un límite superior en el número de bytes consumidos. Esto podría causar agotamiento de memoria en la aplicación consumidora si el servidor OpAMP configurado está controlado por un atacante (o un atacante de red puede realizar un MitM en la conexión) y se devuelve un cuerpo extremadamente grande en la respuesta. Esta vulnerabilidad se corrige en 0.2.0-alpha.1.

Information

Published : 2026-05-12 18:17

Updated : 2026-10-26 18:10

NVD link : CVE-2026-42348

Mitre link : CVE-2026-42348

CVE.ORG link : CVE-2026-42348

JSON object : View

Products Affected

opentelemetry

opentelemetry.opamp.client

CWE

CWE-789

Memory Allocation with Excessive Size Value

{"id": "CVE-2026-42348", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-42348", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-13T19:25:08.216390Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 2.2}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "open-telemetry", "product": "opentelemetry-dotnet-contrib", "versions": [{"status": "affected", "version": "< 0.2.0-alpha.1"}]}]}], "published": "2026-05-12T18:17:24.700", "references": [{"url": "https://github.com/open-telemetry/opentelemetry-dotnet-contrib/pull/4116", "tags": ["Issue Tracking"], "source": "security-advisories@github.com"}, {"url": "https://github.com/open-telemetry/opentelemetry-dotnet-contrib/security/advisories/GHSA-w2jh-77fq-7gp8", "tags": ["Patch", "Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-789"}]}], "descriptions": [{"lang": "en", "value": "OpenTelemetry.OpAmp.Client is the OpAMP client for OpenTelemetry .NET. Prior to 0.2.0-alpha.1, when receiving responses from the OpAMP server over HTTP, the OpAMP client allocates an unbounded buffer to read all bytes from the server, with no upper-bound on the number of bytes consumed. This could cause memory exhaustion in the consuming application if the configured OpAMP server is attacker-controlled (or a network attacker can MitM the connection) and an extremely large body is returned in the response. This vulnerability is fixed in 0.2.0-alpha.1."}, {"lang": "es", "value": "OpenTelemetry.OpAmp.Client es el cliente OpAMP para OpenTelemetry .NET. Antes de 0.2.0-alpha.1, al recibir respuestas del servidor OpAMP a trav\u00e9s de HTTP, el cliente OpAMP asigna un b\u00fafer ilimitado para leer todos los bytes del servidor, sin un l\u00edmite superior en el n\u00famero de bytes consumidos. Esto podr\u00eda causar agotamiento de memoria en la aplicaci\u00f3n consumidora si el servidor OpAMP configurado est\u00e1 controlado por un atacante (o un atacante de red puede realizar un MitM en la conexi\u00f3n) y se devuelve un cuerpo extremadamente grande en la respuesta. Esta vulnerabilidad se corrige en 0.2.0-alpha.1."}], "lastModified": "2026-10-26T18:10:00.173", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:opentelemetry:opentelemetry.opamp.client:*:*:*:*:*:.net:*:*", "vulnerable": true, "matchCriteriaId": "9704A1E4-DB3B-47A9-94BF-468AF748FA9C", "versionEndExcluding": "0.2.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}