PT-2026-37268 · Opentelemetry · Opentelemetry.Opamp.Client

Kielek · Published 2026-05-05 · Updated 2026-05-27 · CVE-2026-42348

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions OpenTelemetry.OpAmp.Client versions prior to 0.2.0-alpha.1

Description When receiving responses from the OpAMP server over HTTP, the client allocates an unbounded buffer to read all bytes from the server without an upper limit on the number of bytes consumed. This occurs because the HTTP transport components use the ReadAsByteArrayAsync() function to copy the HttpResponseMessage.Content into a byte array, allowing an unbounded read of the entire HTTP response message. If the configured OpAMP server is attacker-controlled or a network attacker performs a Man-in-the-Middle (MitM) attack, an extremely large response body could lead to memory exhaustion and a denial-of-service condition in the consuming application.

Recommendations Update to version 0.2.0-alpha.1.

Fix

Weakness Enumeration

CWE-789

Related Identifiers

CVE-2026-42348

GHSA-W2JH-77FQ-7GP8

Affected Products

Opentelemetry.Opamp.Client

References · 9

• https://github.com/open-telemetry/opentelemetry-dotnet-contrib/security/advisories/GHSA-w2jh-77fq-7gp8 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-w2jh-77fq-7gp8 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-42348 · Security Note
• https://github.com/open-telemetry/opentelemetry-dotnet-contrib · Note
• https://github.com/open-telemetry/opentelemetry-dotnet-contrib/pull/4116 · Note
• https://github.com/open-telemetry/opentelemetry-dotnet-contrib/commit/bf1fad4fa298ff451cda0efb0ee9c7a7eb46212a · Note
• https://t.me/cveNotify/164866 · Telegram Post
• https://twitter.com/CVEnew/status/2054340966002155614 · Twitter Post
• https://reddit.com/r/VulnMatter/comments/1t5dfkb/resumen_diario_de_vulnerabilidades_06052026 · Reddit Post