OpenTelemetry-Go Contrib has DoS vulnerability in otelhttp due to unbound cardinality metrics
Priority LOW 36CWE-770Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Partial Red Hat: 14 fixed, 17 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-770.
Summary
OpenTelemetry-Go Contrib is a collection of third-party packages for OpenTelemetry-Go. A handler wrapper out of the box adds labels `http.user_agent` and `http.method` that have unbound cardinality. It leads to the server's potential memory exhaustion when many malicious requests are sent to it. HTTP header User-Agent or HTTP method for requests can be easily set by an attacker to be random and long. The library internally uses `httpconv.ServerRequest` that records every value for HTTP `method` and `User-Agent`. In order to be affected, a program has to use the `otelhttp.NewHandler` wrapper and not filter any unknown HTTP methods or User agents on the level of CDN, LB, previous middleware, etc. Version 0.44.0 fixed this issue when the values collected for attribute `http.request.method` were changed to be restricted to a set of well-known values and other high cardinality attributes were removed. As a workaround to stop being affected, `otelhttp.WithFilter()` can be used, but it requires manual careful configuration to not log certain requests entirely. For convenience and safe usage of this library, it should by default mark with the label `unknown` non-standard HTTP methods and User agents to show that such requests were made but do not increase cardinality. In case someone wants to stay with the current behavior, library API should allow to enable it.
Why it matters now
EPSS 0.01614 76th percentileScored 2026-11-07
Fix Partial opentelemetry-go-contrib (open-telemetry): 0.44.0go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp (Go): 0.44.0+6 more productsRed Hat: 28 advisoriesRed Hat: 14 fixed, 17 without a fix
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| open-telemetry | opentelemetry-go-contrib | before 0.44.0 | 0.44.0 | Patch available | CNA |
| — | go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp (Go) | before 0.44.0 | 0.44.0 | Patch available | GHSA-rcjv-mgp8-qvmr |
| — | go.opentelemetry.io/contrib/instrumentation/github.com/emicklei/go-restful/otelrestful (Go) | before 0.44.0 | 0.44.0 | Patch available | GHSA-rcjv-mgp8-qvmr |
| — | go.opentelemetry.io/contrib/instrumentation/github.com/gin-gonic/gin/otelgin (Go) | before 0.44.0 | 0.44.0 | Patch available | GHSA-rcjv-mgp8-qvmr |
| — | go.opentelemetry.io/contrib/instrumentation/github.com/gorilla/mux/otelmux (Go) | before 0.44.0 | 0.44.0 | Patch available | GHSA-rcjv-mgp8-qvmr |
| — | go.opentelemetry.io/contrib/instrumentation/github.com/labstack/echo/otelecho (Go) | before 0.44.0 | 0.44.0 | Patch available | GHSA-rcjv-mgp8-qvmr |
| — | go.opentelemetry.io/contrib/instrumentation/gopkg.in/macaron.v1/otelmacaron (Go) | before 0.44.0 | 0.44.0 | Patch available | GHSA-rcjv-mgp8-qvmr |
| — | go.opentelemetry.io/contrib/instrumentation/net/http/httptrace/otelhttptrace (Go) | before 0.44.0 | 0.44.0 | Patch available | GHSA-rcjv-mgp8-qvmr |
- opentelemetry-go-contrib Vendoropen-telemetry Affected before 0.44.0 Fixed in 0.44.0 Patch available CNA
- go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp (Go) Vendor— Affected before 0.44.0 Fixed in 0.44.0 Patch available GHSA-rcjv-mgp8-qvmr
- go.opentelemetry.io/contrib/instrumentation/github.com/emicklei/go-restful/otelrestful (Go) Vendor— Affected before 0.44.0 Fixed in 0.44.0 Patch available GHSA-rcjv-mgp8-qvmr
- go.opentelemetry.io/contrib/instrumentation/github.com/gin-gonic/gin/otelgin (Go) Vendor— Affected before 0.44.0 Fixed in 0.44.0 Patch available GHSA-rcjv-mgp8-qvmr
- go.opentelemetry.io/contrib/instrumentation/github.com/gorilla/mux/otelmux (Go) Vendor— Affected before 0.44.0 Fixed in 0.44.0 Patch available GHSA-rcjv-mgp8-qvmr
- go.opentelemetry.io/contrib/instrumentation/github.com/labstack/echo/otelecho (Go) Vendor— Affected before 0.44.0 Fixed in 0.44.0 Patch available GHSA-rcjv-mgp8-qvmr
- go.opentelemetry.io/contrib/instrumentation/gopkg.in/macaron.v1/otelmacaron (Go) Vendor— Affected before 0.44.0 Fixed in 0.44.0 Patch available GHSA-rcjv-mgp8-qvmr
- go.opentelemetry.io/contrib/instrumentation/net/http/httptrace/otelhttptrace (Go) Vendor— Affected before 0.44.0 Fixed in 0.44.0 Patch available GHSA-rcjv-mgp8-qvmr
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:opentelemetry:opentelemetry:*:*:*:*:*:go:*:* | before 0.44.0 | Vulnerable | open-telemetry |
- cpe:2.3:a:opentelemetry:opentelemetry:*:*:*:*:*:go:*:* Versions before 0.44.0 Vulnerable ·open-telemetry
Remediation
- Fix · CNA opentelemetry-go-contrib (open-telemetry) Fixed in 0.44.0
- Fix · GHSA-rcjv-mgp8-qvmr go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp (Go) Fixed in 0.44.0 Advisory →
- Fix · GHSA-rcjv-mgp8-qvmr go.opentelemetry.io/contrib/instrumentation/github.com/emicklei/go-restful/otelrestful (Go) Fixed in 0.44.0 Advisory →
- Fix · GHSA-rcjv-mgp8-qvmr go.opentelemetry.io/contrib/instrumentation/github.com/gin-gonic/gin/otelgin (Go) Fixed in 0.44.0 Advisory →
- Fix · GHSA-rcjv-mgp8-qvmr go.opentelemetry.io/contrib/instrumentation/github.com/gorilla/mux/otelmux (Go) Fixed in 0.44.0 Advisory →
- Fix · GHSA-rcjv-mgp8-qvmr go.opentelemetry.io/contrib/instrumentation/github.com/labstack/echo/otelecho (Go) Fixed in 0.44.0 Advisory →
- Fix · GHSA-rcjv-mgp8-qvmr go.opentelemetry.io/contrib/instrumentation/gopkg.in/macaron.v1/otelmacaron (Go) Fixed in 0.44.0 Advisory →
- Fix · GHSA-rcjv-mgp8-qvmr go.opentelemetry.io/contrib/instrumentation/net/http/httptrace/otelhttptrace (Go) Fixed in 0.44.0 Advisory →
Red Hat 28 advisories
- RHSA-2024:8991 Released 2024-11-13 · Red Hat rating ImportantOpenShift Container Platform 4.15.38 bug fix and security update
- Red Hat OpenShift Container Platform 4.15 openshift4/ose-agent-installer-api-server-rhel8, openshift4/ose-console, openshift4/ose-monitoring-plugin-rhel8 +1
- RHSA-2024:7921 Released 2024-10-15 · Red Hat rating ModerateOpenShift Container Platform 4.17.1 security and extras update
- Red Hat OpenShift Container Platform 4.17 openshift4/ose-ansible-rhel9-operator, openshift4/ose-helm-rhel9-operator, openshift4/ose-operator-sdk-rhel9
- RHSA-2024:6811 Released 2024-09-25 · Red Hat rating ImportantOpenShift Container Platform 4.13.51 bug fix and security update
- Red Hat OpenShift Container Platform 4.13 openshift4/ose-cluster-openshift-controller-manager-operator, openshift4/ose-hypershift-rhel8, openshift4/ose-openshift-apiserver-rhel8 +1
Show 25 more Red Hat advisories
- RHSA-2024:6406 Released 2024-09-11 · Red Hat rating ImportantOpenShift Container Platform 4.14.36 security update
- Red Hat OpenShift Container Platform 4.14 openshift4/cloud-network-config-controller-rhel8, openshift4/driver-toolkit-rhel9, openshift4/egress-router-cni-rhel8 +47
- RHSA-2024:6236 Released 2024-09-03 · Red Hat rating ModerateRed Hat Advanced Cluster Management 2.10.5 security and bug fix update
- Red Hat Advanced Cluster Management for Kubernetes 2.10 for RHEL 9 rhacm2/acm-cluster-permission-rhel9, rhacm2/acm-governance-policy-addon-controller-rhel9, rhacm2/acm-governance-policy-framework-addon-rhel9 +41
- RHSA-2024:5433 Released 2024-08-22 · Red Hat rating ImportantOpenShift Container Platform 4.14.35 security update
- Red Hat OpenShift Container Platform 4.14 openshift4/cloud-network-config-controller-rhel8, openshift4/driver-toolkit-rhel9, openshift4/egress-router-cni-rhel8 +47
- RHSA-2024:0041 Released 2024-06-27 · Red Hat rating CriticalOpenShift Container Platform 4.16.0 bug fix and security update
- Red Hat OpenShift Container Platform 4.16 openshift4/aws-kms-encryption-provider-rhel9, openshift4/azure-kms-encryption-provider-rhel9, openshift4/cloud-network-config-controller-rhel9 +47
- RHSA-2024:4118 Released 2024-06-26 · Red Hat rating ModerateRed Hat Ceph Storage 5.3 security, bug fix, and enhancement update
- Red Hat Ceph Storage 5.3 MON ceph-2:16.2.10-266.el8cp, ceph-base-2:16.2.10-266.el8cp, ceph-common-2:16.2.10-266.el8cp +30
- Red Hat Ceph Storage 5.3 OSD ceph-2:16.2.10-266.el8cp, ceph-base-2:16.2.10-266.el8cp, ceph-common-2:16.2.10-266.el8cp +20
- Red Hat Ceph Storage 5.3 Tools ceph-2:16.2.10-266.el8cp, ceph-2:16.2.10-266.el9cp, ceph-ansible-6.0.28.8-1.el8cp +47
- RHSA-2024:2773 Released 2024-05-15 · Red Hat rating ImportantOpenShift Container Platform 4.15.13 bug fix and security update
- Red Hat OpenShift Container Platform 4.15 openshift4/ose-agent-installer-node-agent-rhel9, openshift4/ose-azure-workload-identity-webhook-rhel8, openshift4/ose-cluster-api-rhel9 +3
- RHSA-2024:1859 Released 2024-04-16 · Red Hat rating ModerateOpenShift API for Data Protection (OADP) 1.3.1 security and bug fix update
- 9Base-OADP-1.3 oadp/oadp-rhel9-operator, oadp/oadp-velero-plugin-for-csi-rhel9, oadp/oadp-velero-plugin-for-gcp-rhel9 +3
- RHSA-2024:1328 Released 2024-03-14 · Red Hat rating ModerateRed Hat Advanced Cluster Management 2.9.3 security and bug fix container updates
- Red Hat Advanced Cluster Management for Kubernetes 2.9 for RHEL 8 rhacm2/acm-governance-policy-addon-controller-rhel8
- RHSA-2024:0766 Released 2024-02-28 · Red Hat rating CriticalOpenShift Container Platform 4.15.0 security update
- Red Hat OpenShift Container Platform 4.15 openshift4/ose-aws-efs-csi-driver-container-rhel8, openshift4/ose-aws-efs-csi-driver-rhel8-operator, openshift4/ose-ptp-rhel9-operator
- RHSA-2023:7198 Released 2024-02-27 · Red Hat rating CriticalOpenShift Container Platform 4.15.0 bug fix and security update
- Red Hat OpenShift Container Platform 4.15 openshift4/cloud-network-config-controller-rhel8, openshift4/egress-router-cni-rhel8, openshift4/kube-metrics-server-rhel8 +47
- RHSA-2023:7197 Released 2024-02-27 · Red Hat rating CriticalOpenShift Container Platform 4.15.0 security and extras update
- Red Hat OpenShift Container Platform 4.15 openshift4/ose-ansible-operator, openshift4/ose-clusterresourceoverride-rhel9, openshift4/ose-clusterresourceoverride-rhel9-operator +7
- RHSA-2024:0833 Released 2024-02-21 · Red Hat rating CriticalOpenShift Container Platform 4.12.50 bug fix and security update
- Red Hat OpenShift Container Platform 4.12 openshift4/ose-alibaba-cloud-controller-manager-rhel8, openshift4/ose-cluster-authentication-operator, openshift4/ose-operator-lifecycle-manager +4
- RHSA-2024:0642 Released 2024-02-07 · Red Hat rating CriticalOpenShift Container Platform 4.14.11 bug fix and security update
- Red Hat OpenShift Container Platform 4.14 openshift4/ose-aws-cloud-controller-manager-rhel8, openshift4/ose-azure-cluster-api-controllers-rhel8, openshift4/ose-cluster-api-rhel8 +7
- RHSA-2024:0641 Released 2024-02-07 · Red Hat rating CriticalOpenShift Container Platform 4.14.11 security and extras update
- Red Hat OpenShift Container Platform 4.14 openshift4/ose-ansible-operator, openshift4/ose-helm-operator, openshift4/ose-kubernetes-nmstate-handler-rhel9 +1
- RHSA-2024:0660 Released 2024-02-07 · Red Hat rating ImportantOpenShift Container Platform 4.13.32 bug fix and security update
- Red Hat OpenShift Container Platform 4.13 openshift4/ose-sdn-rhel8, openshift4/ose-thanos-rhel8
- RHSA-2024:0204 Released 2024-01-17 · Red Hat rating ModerateOpenShift Container Platform 4.14.9 bug fix and security update
- Red Hat OpenShift Container Platform 4.14 openshift4/ose-openstack-cinder-csi-driver-rhel8-operator
- RHSA-2024:0050 Released 2024-01-09 · Red Hat rating ImportantOpenShift Container Platform 4.14.8 bug fix and security update
- Red Hat OpenShift Container Platform 4.14 openshift4/ose-alibaba-cloud-controller-manager-rhel8, openshift4/ose-cluster-olm-operator-rhel8, openshift4/ose-olm-operator-controller-rhel8
- RHSA-2023:7831 Released 2024-01-03 · Red Hat rating ImportantOpenShift Container Platform 4.14.7 bug fix and security update
- Red Hat OpenShift Container Platform 4.14 openshift4/ose-cluster-network-operator, openshift4/ose-ibm-cloud-controller-manager-rhel8, openshift4/ose-operator-registry +4
- RHSA-2023:7682 Released 2023-12-12 · Red Hat rating ImportantOpenShift Container Platform 4.14.6 bug fix and security update
- Red Hat OpenShift Container Platform 4.14 openshift4/ose-gcp-cloud-controller-manager-rhel8, openshift4/ose-prometheus
- RHSA-2023:7681 Released 2023-12-12 · Red Hat rating ImportantOpenShift Container Platform 4.14.6 security and extras update
- Red Hat OpenShift Container Platform 4.14 openshift4/nmstate-console-plugin-rhel8, openshift4/ose-clusterresourceoverride-rhel8, openshift4/ose-clusterresourceoverride-rhel8-operator +1
- RHSA-2023:7663 Released 2023-12-06 · Red Hat rating ImportantRed Hat OpenShift distributed tracing 3.0.0 operator/operand containers
- Red Hat OpenShift distributed tracing 3.0 rhosdt/jaeger-agent-rhel8, rhosdt/jaeger-all-in-one-rhel8, rhosdt/jaeger-collector-rhel8 +8
- RHSA-2023:7599 Released 2023-12-05 · Red Hat rating ImportantOpenShift Container Platform 4.14.5 bug fix and security update
- Red Hat OpenShift Container Platform 4.14 openshift4/ose-multus-networkpolicy-rhel8, openshift4/ose-openshift-apiserver-rhel8, openshift4/ose-operator-registry
- RHSA-2023:7470 Released 2023-11-29 · Red Hat rating ImportantOpenShift Container Platform 4.14.4 bug fix and security update
- Red Hat OpenShift Container Platform 4.14 openshift4/ose-azure-cloud-node-manager-rhel8, openshift4/ose-cloud-credential-operator, openshift4/ose-ibmcloud-cluster-api-controllers-rhel8 +7
- RHSA-2023:7469 Released 2023-11-29 · Red Hat rating ImportantOpenShift Container Platform 4.14.4 security and extras update
- Red Hat OpenShift Container Platform 4.14 openshift4/ose-aws-efs-csi-driver-rhel8-operator, openshift4/ose-clusterresourceoverride-rhel8, openshift4/ose-clusterresourceoverride-rhel8-operator +1
- RHSA-2023:7555 Released 2023-11-28 · Red Hat rating ImportantOpenShift API for Data Protection (OADP) 1.3.0 security update
- 9Base-OADP-1.3 oadp/oadp-kubevirt-velero-plugin-rhel9, oadp/oadp-mustgather-rhel9, oadp/oadp-operator-bundle +8
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Logical Volume Manager Storage | Affected | No fix yet |
| OpenShift API for Data Protection | Affected | No fix planned: Will not fix |
| OpenShift Run Once Duration Override Operator | Affected | No fix planned: Will not fix |
| OpenShift Secondary Scheduler Operator | Affected | No fix planned: Will not fix |
| Red Hat 3scale API Management Platform 2 | Affected | No fix yet |
| Red Hat Advanced Cluster Management for Kubernetes 2 | Affected | No fix yet |
| Red Hat Certification Program for Red Hat Enterprise Linux 9 | Affected | No fix yet: Fix deferred |
| Red Hat Certification for Red Hat Enterprise Linux 8 | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift Container Platform 4 | Affected | No fix yet |
| Red Hat OpenShift Data Science (RHODS) | Affected | No fix yet |
| Red Hat OpenShift GitOps | Affected | No fix planned: Will not fix |
| Red Hat OpenShift Virtualization 4 | Affected | No fix yet |
| Red Hat OpenShift distributed tracing 2 | Affected | No fix yet |
| Red Hat Openshift Data Foundation 4 | Affected | No fix planned: Will not fix |
| Red Hat Openshift Sandboxed Containers | Affected | No fix yet |
| Red Hat Quay 3 | Affected | No fix yet |
| cert-manager Operator for Red Hat OpenShift | Affected | No fix yet |
| 8Base-MTV-2.5 | Fixed | — |
| 9Base-OADP-1.3 | Fixed | RHSA-2023:7555, RHSA-2024:1859 |
| Red Hat Advanced Cluster Management for Kubernetes 2.10 for RHEL 9 | Fixed | RHSA-2024:6236 |
| Red Hat Advanced Cluster Management for Kubernetes 2.9 for RHEL 8 | Fixed | RHSA-2024:1328 |
| Red Hat Ceph Storage 5.3 MON | Fixed | RHSA-2024:4118 |
| Red Hat Ceph Storage 5.3 OSD | Fixed | RHSA-2024:4118 |
| Red Hat Ceph Storage 5.3 Tools | Fixed | RHSA-2024:4118 |
| Red Hat OpenShift Container Platform 4.12 | Fixed | RHSA-2024:0833 |
| Red Hat OpenShift Container Platform 4.13 | Fixed | RHSA-2024:0660, RHSA-2024:6811 |
| Red Hat OpenShift Container Platform 4.14 | Fixed | RHSA-2023:7469, RHSA-2023:7470, RHSA-2023:7599, RHSA-2023:7681, RHSA-2023:7682, RHSA-2023:7831, RHSA-2024:0050, RHSA-2024:0204, RHSA-2024:0641, RHSA-2024:0642, RHSA-2024:5433, RHSA-2024:6406 |
| Red Hat OpenShift Container Platform 4.15 | Fixed | RHSA-2023:7197, RHSA-2023:7198, RHSA-2024:0766, RHSA-2024:2773, RHSA-2024:8991 |
| Red Hat OpenShift Container Platform 4.16 | Fixed | RHSA-2024:0041 |
| Red Hat OpenShift Container Platform 4.17 | Fixed | RHSA-2024:7921 |
| Red Hat OpenShift distributed tracing 3.0 | Fixed | RHSA-2023:7663 |
Not affected: 18 products
- 8Base-MTV-2.5
- 9Base-OADP-1.3
- Logging Subsystem for Red Hat OpenShift
- Logical Volume Manager Storage
- OpenShift API for Data Protection
- OpenShift Serverless
- Red Hat Advanced Cluster Management for Kubernetes 2.9 for RHEL 8
- Red Hat OpenShift Container Platform 4
- Red Hat OpenShift Container Platform 4.12
- Red Hat OpenShift Container Platform 4.13
- Red Hat OpenShift Container Platform 4.14
- Red Hat OpenShift Container Platform 4.15
- Red Hat OpenShift Container Platform 4.16
- Red Hat OpenShift Container Platform 4.17
- Red Hat OpenShift Container Platform 5
- Red Hat OpenShift distributed tracing 3.0
- Red Hat Openshift Data Foundation 4
- cert-manager Operator for Red Hat OpenShift
Timeline
- 2026-10-02 Threatist record created from CVE-2023-45142
- 2026-10-03 Alias added: GHSA-rcjv-mgp8-qvmr
- 2026-11-06 Affected versions changed · Red Hat
References
Advisory 4
Other 8
- https://github.com/open-telemetry/opentelemetry-go-contrib/pull/4277
- https://github.com/open-telemetry/opentelemetry-go-contrib/blob/5f7e6ad5a49b45df45f61a1deb29d7f1158032df/instrumentation/net/http/otelhttp/handler.go#L63-L65
- https://github.com/open-telemetry/opentelemetry-go-contrib/releases/tag/v1.19.0
- https://github.com/open-telemetry/opentelemetry-go/blob/38e1b499c3da3107694ad2660b3888eee9c8b896/semconv/internal/v2/http.go#L223
- https://github.com/open-telemetry/opentelemetry-go/blob/v1.12.0/semconv/internal/v2/http.go#L159
- https://lists.fedoraproject.org/archives/list/[email protected]/message/2UTRJ54INZG3OC2FTAN6AFB2RYNY2GAD/
- https://github.com/open-telemetry/opentelemetry-go-contrib
- https://lists.fedoraproject.org/archives/list/[email protected]/message/2UTRJ54INZG3OC2FTAN6AFB2RYNY2GAD
More open-telemetry Opentelemetry vulnerabilities
- TI-2026-23298 OpenTelemetry-Go multi-value `baggage` header extraction causes excessive allocations (remote dos amplification) CVSS 3.1HIGH 7.5
- TI-2023-25448 DoS vulnerability in otelgrpc (uncontrolled resource consumption) due to unbound cardinality metrics CVSS 3.1HIGH 7.5
- TI-2026-29801 OpenTelemetry-Go's baggage parsing no longer caps raw header length CVSS 3.1MEDIUM 5.3
- TI-2026-32829 opentelemetry-cpp: OTLP HTTP exporters read unbounded HTTP response CVSS 3.1MEDIUM 5.3
- TI-2023-23498 opentelemetry-instrumentation Denial of Service vulnerability due to unbound cardinality metrics CVSS 3.1HIGH 7.5
- TI-2026-28762 Untrusted search path in open-telemetry opentelemetry-go CVSS 4.0HIGH 7.3
Sources
- CVE-2023-45142 · CVE Program
- CVE-2023-45142 · NVD
- FIRST EPSS
- GHSA-rcjv-mgp8-qvmr · GitHub Advisory Database · CC BY 4.0
- CVE-2023-45142 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences