TI-2023-23498 Aliases CVE-2023-43810 GHSA-5rv5-6h4r-h22v

opentelemetry-instrumentation Denial of Service vulnerability due to unbound cardinality metrics

MEDIUM 40CWE-400Published 2023-10-06 · Updated 2024-09-19

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Denial of service
Confidentiality · integrity · availability: None · None · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-400.

Summary

OpenTelemetry, also known as OTel for short, is a vendor-neutral open-source Observability framework for instrumenting, generating, collecting, and exporting telemetry data such as traces, metrics, logs. Autoinstrumentation out of the box adds the label `http_method` that has unbound cardinality. It leads to the server's potential memory exhaustion when many malicious requests are sent. HTTP method for requests can be easily set by an attacker to be random and long. In order to be affected program has to be instrumented for HTTP handlers and does not filter any unknown HTTP methods on the level of CDN, LB, previous middleware, etc. This issue has been patched in version 0.41b0.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00845 58th percentileScored 2026-11-07

Fix Fixed opentelemetry-python-contrib (open-telemetry): 0.41b0opentelemetry-instrumentation (PyPI): 0.41b0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: Yes
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
open-telemetry	opentelemetry-python-contrib	before 0.41b0	0.41b0	Patch available	CNA
—	opentelemetry-instrumentation (PyPI)	before 0.41b0	0.41b0	Patch available	GHSA-5rv5-6h4r-h22v

opentelemetry-python-contrib Vendoropen-telemetry Affected before 0.41b0 Fixed in 0.41b0 Patch available CNA
opentelemetry-instrumentation (PyPI) Vendor— Affected before 0.41b0 Fixed in 0.41b0 Patch available GHSA-5rv5-6h4r-h22v

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:opentelemetry:opentelemetry::::::::	before 0.41b0	Vulnerable	open-telemetry

cpe:2.3:a:opentelemetry:opentelemetry:*:*:*:*:*:*:*:* Versions before 0.41b0 Vulnerable ·open-telemetry

Remediation

Fix · CNA opentelemetry-python-contrib (open-telemetry) Fixed in 0.41b0
Fix · GHSA-5rv5-6h4r-h22v opentelemetry-instrumentation (PyPI) Fixed in 0.41b0 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2023-43810
2026-10-03 Alias added: GHSA-5rv5-6h4r-h22v

References

Patch 1

https://github.com/open-telemetry/opentelemetry-python-contrib/commit/6007e0c013071e7f8b9612d3bc68aeb9d600d74e

Advisory 2

Other 2

TI-2026-23298 OpenTelemetry-Go multi-value `baggage` header extraction causes excessive allocations (remote dos amplification) CVSS 3.1HIGH 7.5
TI-2023-25448 DoS vulnerability in otelgrpc (uncontrolled resource consumption) due to unbound cardinality metrics CVSS 3.1HIGH 7.5
TI-2026-29801 OpenTelemetry-Go's baggage parsing no longer caps raw header length CVSS 3.1MEDIUM 5.3
TI-2026-32829 opentelemetry-cpp: OTLP HTTP exporters read unbounded HTTP response CVSS 3.1MEDIUM 5.3
TI-2023-24163 OpenTelemetry-Go Contrib has DoS vulnerability in otelhttp due to unbound cardinality metrics CVSS 3.1HIGH 7.5
TI-2026-28762 Untrusted search path in open-telemetry opentelemetry-go CVSS 4.0HIGH 7.3

See all 13 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences