CVE-2026-42348
OpAMP client reads unbounded HTTP response bodies
CVSS Score
5.9
EPSS Score
0.0%
EPSS Percentile
0th
OpenTelemetry.OpAmp.Client is the OpAMP client for OpenTelemetry .NET. Prior to 0.2.0-alpha.1, when receiving responses from the OpAMP server over HTTP, the OpAMP client allocates an unbounded buffer to read all bytes from the server, with no upper-bound on the number of bytes consumed. This could cause memory exhaustion in the consuming application if the configured OpAMP server is attacker-controlled (or a network attacker can MitM the connection) and an extremely large body is returned in the response. This vulnerability is fixed in 0.2.0-alpha.1.
| CWE | CWE-789 |
| Vendor | open-telemetry |
| Product | opentelemetry-dotnet-contrib |
| Published | May 12, 2026 |
Stay Ahead of the Next One
Get instant alerts for open-telemetry opentelemetry-dotnet-contrib
Be the first to know when new medium vulnerabilities affecting open-telemetry opentelemetry-dotnet-contrib are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High
Affected Versions
open-telemetry / opentelemetry-dotnet-contrib
< 0.2.0-alpha.1