PT-2026-34721 · Unknown · Opentelemetry.Sampler.Aws+1

Published

2026-04-23

·

Updated

2026-04-28

·

CVE-2026-41173

CVSS v3.1

5.9

Medium

VectorAV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Name of the Vulnerable Software and Affected Versions OpenTelemetry.Sampler.AWS versions prior to 0.1.0-alpha.8 OpenTelemetry.Resources.AWS versions prior to 1.15.1
Description OpenTelemetry.Sampler.AWS and OpenTelemetry.Resources.AWS read unbounded HTTP response bodies from configured endpoints into memory. In OpenTelemetry.Sampler.AWS, the AWSXRaySamplerClient.DoRequestAsync function calls HttpClient.SendAsync followed by ReadAsStringAsync(), which materializes the entire response body into a single in-memory string without a size limit. The sampling endpoint is configurable via AWSXRayRemoteSamplerBuilder.SetEndpoint (default: 'http://localhost:2000'). In OpenTelemetry.Resources.AWS, the AWSEC2Detector(), AWSECSDetector(), and AWSEKSDetector() functions make HTTP requests to AWS metadata services ('http://169.254.169.254', ECS CONTAINER METADATA URI/ECS CONTAINER METADATA URI V4, or 'https://kubernetes.default.svc'). An attacker who controls these endpoints or performs a Man-in-the-Middle (MitM) attack can return an arbitrarily large response body, causing unbounded heap allocation. This leads to high transient memory pressure, garbage-collection stalls, or an OutOfMemoryException that terminates the process, resulting in a Denial of Service (DoS).
Recommendations Update OpenTelemetry.Sampler.AWS to version 0.1.0-alpha.8. Update OpenTelemetry.Resources.AWS to version 1.15.1. Ensure the X-Ray sampling endpoint is not accessible to untrusted parties. Use network-level controls such as firewall rules, mTLS, or service mesh to prevent Man-in-the-Middle (MitM) attacks on the sampling endpoint and EC2/ECS/EKS connections. Place remote endpoints behind a reverse proxy that enforces a response body size limit.

Fix

DoS

Allocation of Resources Without Limits

Found an issue in the description? Have something to add? Feel free to write us 👾

Weakness Enumeration

Related Identifiers

CVE-2026-41173
GHSA-28XM-PRXC-5866

Affected Products

Opentelemetry.Resources.Aws
Opentelemetry.Sampler.Aws