PT-2023-9340 · Unknown+2 · Opentelemetry-Go Contrib+2
Pellared
·
Published
2023-11-10
·
Updated
2025-10-28
·
CVE-2023-47108
CVSS v2.0
7.8
High
| Vector | AV:N/AC:L/Au:N/C:N/I:N/A:C |
Name of the Vulnerable Software and Affected Versions
OpenTelemetry-Go Contrib versions prior to 0.46.0
Description
The issue is related to the grpc Unary Server Interceptor adding labels
net.peer.sock.addr and net.peer.sock.port with unbound cardinality, leading to potential memory exhaustion when many malicious requests are sent. An attacker can easily flood the peer address and port for requests, causing a denial-of-service.Recommendations
For versions prior to 0.46.0, as a temporary workaround, consider using a view that removes the attributes
net.peer.sock.addr and net.peer.sock.port.
Alternatively, disable grpc metrics instrumentation by passing otelgrpc.WithMeterProvider option with noop.NewMeterProvider.
For a permanent solution, upgrade to version 0.46.0 or later, which contains a fix for this issue.Exploit
Fix
DoS
Allocation of Resources Without Limits
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Opentelemetry-Go Contrib
Red Os
Suse