CVE-2026-44967

OpenTelemetry-cpp is the C++ implementation of OpenTelemetry. Prior to release 1.27.0, the OTLP HTTP exporters (traces/metrics/logs) read the full HTTP response into an in-memory vector of bytes without a size cap. This is exploitable for memory exhaustion when the configured collector endpoint is attacker-controlled (or a network attacker can MITM the exporter connection). This vulnerability is fixed in opentelemetry-cpp release 1.27.0.

CVSS v3 5.3 MEDIUM

5.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.6 / Impact : 3.6

Attack Vector ADJACENT_NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/open-telemetry/opentelemetry-cpp/issues/3958	Issue Tracking
https://github.com/open-telemetry/opentelemetry-cpp/pull/4078	Issue Tracking
https://github.com/open-telemetry/opentelemetry-cpp/security/advisories/GHSA-5qhm-4rfp-qqvj	Vendor Advisory
https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-w8rr-5gcm-pp58	Not Applicable Vendor Advisory
https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-w8rr-5gcm-pp58	Not Applicable Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:opentelemetry:opentelemetry:*:*:*:*:*:c\+\+:*:*

History

26 Oct 2026, 11:10

Type	Values Removed	Values Added
Summary		(es) OpenTelemetry-cpp es la implementación en C++ de OpenTelemetry. Antes de la versión 1.27.0, los exportadores HTTP de OTLP (rastros/métricas/registros) leían la respuesta HTTP completa en un vector de bytes en memoria sin un límite de tamaño. Esto es explotable para el agotamiento de memoria cuando el punto final del recolector configurado está controlado por el atacante (o un atacante de red puede realizar un MitM en la conexión del exportador). Esta vulnerabilidad está corregida en la versión 1.27.0 de opentelemetry-cpp.

Information

Published : 2026-06-12 16:16

Updated : 2026-10-26 11:10

NVD link : CVE-2026-44967

Mitre link : CVE-2026-44967

CVE.ORG link : CVE-2026-44967

JSON object : View

Products Affected

opentelemetry

opentelemetry

CWE

CWE-789

Memory Allocation with Excessive Size Value

{"id": "CVE-2026-44967", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-44967", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-12T16:10:44.803865Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 1.6}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 1.6}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "open-telemetry", "product": "opentelemetry-cpp", "versions": [{"status": "affected", "version": "< 1.27.0"}]}]}], "published": "2026-06-12T16:16:27.973", "references": [{"url": "https://github.com/open-telemetry/opentelemetry-cpp/issues/3958", "tags": ["Issue Tracking"], "source": "security-advisories@github.com"}, {"url": "https://github.com/open-telemetry/opentelemetry-cpp/pull/4078", "tags": ["Issue Tracking"], "source": "security-advisories@github.com"}, {"url": "https://github.com/open-telemetry/opentelemetry-cpp/security/advisories/GHSA-5qhm-4rfp-qqvj", "tags": ["Vendor Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-w8rr-5gcm-pp58", "tags": ["Not Applicable", "Vendor Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-w8rr-5gcm-pp58", "tags": ["Not Applicable", "Vendor Advisory"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-789"}]}], "descriptions": [{"lang": "en", "value": "OpenTelemetry-cpp is the C++ implementation of OpenTelemetry. Prior to release 1.27.0, the OTLP HTTP exporters (traces/metrics/logs) read the full HTTP response into an in-memory vector of bytes without a size cap. This is exploitable for memory exhaustion when the configured collector endpoint is attacker-controlled (or a network attacker can MITM the exporter connection). This vulnerability is fixed in opentelemetry-cpp release 1.27.0."}, {"lang": "es", "value": "OpenTelemetry-cpp es la implementaci\u00f3n en C++ de OpenTelemetry. Antes de la versi\u00f3n 1.27.0, los exportadores HTTP de OTLP (rastros/m\u00e9tricas/registros) le\u00edan la respuesta HTTP completa en un vector de bytes en memoria sin un l\u00edmite de tama\u00f1o. Esto es explotable para el agotamiento de memoria cuando el punto final del recolector configurado est\u00e1 controlado por el atacante (o un atacante de red puede realizar un MitM en la conexi\u00f3n del exportador). Esta vulnerabilidad est\u00e1 corregida en la versi\u00f3n 1.27.0 de opentelemetry-cpp."}], "lastModified": "2026-10-26T11:10:00.157", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:opentelemetry:opentelemetry:*:*:*:*:*:c\\+\\+:*:*", "vulnerable": true, "matchCriteriaId": "E6B7D91B-4209-406A-9687-9A049D494ECB", "versionEndExcluding": "1.27.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}