PT-2022-7151 · Unknown+3 · Opentelemetry-Go Contrib+3
Programmer04
·
Published
2022-02-16
·
Updated
2025-08-01
·
CVE-2023-45142
CVSS v2.0
7.8
High
| Vector | AV:N/AC:L/Au:N/C:N/I:N/A:C |
Name of the Vulnerable Software and Affected Versions
OpenTelemetry-Go Contrib versions prior to 0.44.0
Description
The issue is related to a denial-of-service attack that can cause memory exhaustion when handling requests with non-standard HTTP methods or User-Agents. The library internally uses
httpconv.ServerRequest that records every value for HTTP method and User-Agent. To be affected, a program must use the otelhttp.NewHandler wrapper and not filter any unknown HTTP methods or User agents on the level of CDN, LB, previous middleware, etc. The values collected for attribute http.request.method were changed to be restricted to a set of well-known values and other high cardinality attributes were removed in version 0.44.0.Recommendations
For versions prior to 0.44.0, as a workaround to stop being affected,
otelhttp.WithFilter() can be used, but it requires manual careful configuration to not log certain requests entirely. It is recommended to upgrade to version 0.44.0 or later, where the values collected for attribute http.request.method were changed to be restricted to a set of well-known values and other high cardinality attributes were removed. Additionally, consider disabling HTTP metrics instrumentation by passing otelhttp.WithMeterProvider option with noop.NewMeterProvider.Exploit
Fix
DoS
Missing Release of Resource after Effective Lifetime
Allocation of Resources Without Limits
Resource Exhaustion
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Alt Linux
Opentelemetry-Go Contrib
Red Os
Suse