Read the docs
TI-2023-10613 Aliases CVE-2023-25151GHSA-5r5m-65gx-7vrh

DoS vulnerability for high cardinality metrics in opentelemetry-go-contrib

Priority HIGH 72CWE-400Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-400.

Summary

opentelemetry-go-contrib is a collection of extensions for OpenTelemetry-Go. The v0.38.0 release of `go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp` uses the `httpconv.ServerRequest` function to annotate metric measurements for the `http.server.request_content_length`, `http.server.response_content_length`, and `http.server.duration` instruments. The `ServerRequest` function sets the `http.target` attribute value to be the whole request URI (including the query string)[^1]. The metric instruments do not "forget" previous measurement attributes when `cumulative` temporality is used, this means the cardinality of the measurements allocated is directly correlated with the unique URIs handled. If the query string is constantly random, this will result in a constant increase in memory allocation that can be used in a denial-of-service attack. This issue has been addressed in version 0.39.0. Users are advised to upgrade. There are no known workarounds for this issue.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00973 62nd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed opentelemetry-go-contrib (open-telemetry): 0.39.0go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp (Go): 0.39.0+1 more product

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
open-telemetryopentelemetry-go-contrib0.38.0 to before 0.39.00.39.0Patch availableCNA
—go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp (Go)0.38.0 to before 0.39.00.39.0Patch availableGHSA-5r5m-65gx-7vrh
—go.opentelemetry.io/contrib/instrumentation/github.com/astaxie/beego/otelbeego (Go)0.38.0 to before 0.39.00.39.0Patch availableGHSA-5r5m-65gx-7vrh
  • opentelemetry-go-contrib Vendoropen-telemetry Affected 0.38.0 to before 0.39.0 Fixed in 0.39.0 Patch available CNA
  • go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp (Go) Vendor— Affected 0.38.0 to before 0.39.0 Fixed in 0.39.0 Patch available GHSA-5r5m-65gx-7vrh
  • go.opentelemetry.io/contrib/instrumentation/github.com/astaxie/beego/otelbeego (Go) Vendor— Affected 0.38.0 to before 0.39.0 Fixed in 0.39.0 Patch available GHSA-5r5m-65gx-7vrh

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:linuxfoundation:opentelemetry-go_contrib:0.38.0:*:*:*:*:opentelemetry-go:*:*0.38.0Vulnerablebackstage
  • cpe:2.3:a:linuxfoundation:opentelemetry-go_contrib:0.38.0:*:*:*:*:opentelemetry-go:*:* Versions 0.38.0 Vulnerable ·backstage

Remediation

  • Fix · CNA opentelemetry-go-contrib (open-telemetry) Fixed in 0.39.0
  • Fix · GHSA-5r5m-65gx-7vrh go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp (Go) Fixed in 0.39.0 Advisory →
  • Fix · GHSA-5r5m-65gx-7vrh go.opentelemetry.io/contrib/instrumentation/github.com/astaxie/beego/otelbeego (Go) Fixed in 0.39.0 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

Not affected: 19 products
  • Cryostat 2
  • Custom Metric Autoscaler operator for Red Hat Openshift
  • Logging Subsystem for Red Hat OpenShift
  • Migration Toolkit for Containers
  • Node Maintenance Operator
  • OpenShift API for Data Protection
  • OpenShift Developer Tools and Services
  • OpenShift Serverless
  • Red Hat Advanced Cluster Management for Kubernetes 2
  • Red Hat Advanced Cluster Security 3
  • Red Hat OpenShift Container Platform 4
  • Red Hat OpenShift GitOps
  • Red Hat OpenShift Virtualization 4
  • Red Hat OpenShift distributed tracing 2
  • Red Hat OpenStack Platform 16.2
  • Red Hat Openshift Data Foundation 4
  • Red Hat Openshift Sandboxed Containers
  • Red Hat Quay 3
  • cert-manager Operator for Red Hat OpenShift

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-25151
  2. 2026-10-03 Alias added: GHSA-5r5m-65gx-7vrh

References

Exploit 1

Advisory 2

Other 1

  • TI-2024-23957 OpenTelemetry Collector has a Denial of Service via Zip/Decompression Bomb sent over HTTP or gRPC CVSS 3.1HIGH 8.2
  • TI-2026-42706 OpenTelemetry JavaScript: Denial of service in `JaegerPropagator` via unhandled exception on a malformed header CVSS 3.1HIGH 7.5
  • TI-2026-33428 OpenTelemetry eBPF Instrumentation: Memcached payload length overflow can crash OBI CVSS 3.1HIGH 7.5
  • TI-2026-33427 OpenTelemetry eBPF Instrumentation: MongoDB parser panics on malformed wire messages CVSS 3.1HIGH 7.5
  • TI-2026-33420 OpenTelemetry eBPF Instrumentation: Postgres BIND parsing can panic on malformed payloads CVSS 3.1HIGH 7.5
  • TI-2026-32777 opentelemetry-js: Prometheus exporter process crash via malformed HTTP request CVSS 3.1HIGH 7.5
See all 62 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences