Read the docs
TI-2023-25448 Aliases CVE-2023-47108GHSA-8pgv-569h-w5rw

DoS vulnerability in otelgrpc (uncontrolled resource consumption) due to unbound cardinality metrics

Priority HIGH 72CWE-770Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 13 fixed, 9 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-770.

Summary

OpenTelemetry-Go Contrib is a collection of third-party packages for OpenTelemetry-Go. Starting in version 0.37.0 and prior to version 0.46.0, the grpc Unary Server Interceptor out of the box adds labels `net.peer.sock.addr` and `net.peer.sock.port` that have unbound cardinality. It leads to the server's potential memory exhaustion when many malicious requests are sent. An attacker can easily flood the peer address and port for requests. Version 0.46.0 contains a fix for this issue. As a workaround to stop being affected, a view removing the attributes can be used. The other possibility is to disable grpc metrics instrumentation by passing `otelgrpc.WithMeterProvider` option with `noop.NewMeterProvider`.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.02026 81st percentileScored 2026-11-07
Fix Partial opentelemetry-go-contrib (open-telemetry): 0.46.0go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc (Go): 0.46.0Red Hat: 33 advisoriesRed Hat: 13 fixed, 9 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
open-telemetryopentelemetry-go-contrib0.37.0 to before 0.46.00.46.0Patch availableCNA
—go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc (Go)0.37.0 to before 0.46.00.46.0Patch availableGHSA-8pgv-569h-w5rw
  • opentelemetry-go-contrib Vendoropen-telemetry Affected 0.37.0 to before 0.46.0 Fixed in 0.46.0 Patch available CNA
  • go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc (Go) Vendor— Affected 0.37.0 to before 0.46.0 Fixed in 0.46.0 Patch available GHSA-8pgv-569h-w5rw

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:opentelemetry:opentelemetry:*:*:*:*:*:go:*:*before 0.46.0Vulnerableopen-telemetry
  • cpe:2.3:a:opentelemetry:opentelemetry:*:*:*:*:*:go:*:* Versions before 0.46.0 Vulnerable ·open-telemetry

Remediation

  • Fix · CNA opentelemetry-go-contrib (open-telemetry) Fixed in 0.46.0
  • Fix · GHSA-8pgv-569h-w5rw go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc (Go) Fixed in 0.46.0 Advisory →

Red Hat 33 advisories

  • RHSA-2025:0029 Released 2025-01-09 · Red Hat rating Moderate
    OpenShift Container Platform 4.14.44 bug fix and security update
    • Red Hat OpenShift Container Platform 4.14 openshift4/ose-ibmcloud-machine-controllers-rhel8, openshift4/ose-nutanix-cloud-controller-manager-rhel8
  • RHSA-2024:11293 Released 2024-12-17 · Red Hat rating Moderate
    Multicluster Engine for Kubernetes 2.6.4 security enhancements and bug fixes
    • multicluster engine for Kubernetes 2.6 for RHEL 8 multicluster-engine/assisted-image-service-rhel8, multicluster-engine/assisted-installer-agent-rhel8, multicluster-engine/assisted-installer-controller-rhel8 +2
    • multicluster engine for Kubernetes 2.6 for RHEL 9 multicluster-engine/addon-manager-rhel9, multicluster-engine/assisted-service-9-rhel9, multicluster-engine/backplane-rhel9-operator +27
  • RHSA-2024:10857 Released 2024-12-05 · Red Hat rating Moderate
    Multicluster Engine for Kubernetes 2.7.2 security updates and bug fixes
    • multicluster engine for Kubernetes 2.7 for RHEL 8 multicluster-engine/assisted-service-8-rhel8
    • multicluster engine for Kubernetes 2.7 for RHEL 9 multicluster-engine/addon-manager-rhel9, multicluster-engine/assisted-image-service-rhel9, multicluster-engine/assisted-installer-agent-rhel9 +31
Show 30 more Red Hat advisories
  • RHSA-2024:8235 Released 2024-10-23 · Red Hat rating Important
    OpenShift Container Platform 4.14.39 security update
    • Red Hat OpenShift Container Platform 4.14 openshift4/ose-agent-installer-api-server-rhel8, openshift4/ose-cluster-baremetal-operator-rhel8, openshift4/ose-ibm-cloud-controller-manager-rhel8 +5
  • RHSA-2024:7184 Released 2024-10-03 · Red Hat rating Moderate
    OpenShift Container Platform 4.14.38 security update
    • Red Hat OpenShift Container Platform 4.14 openshift4/ose-agent-installer-node-agent-rhel9, openshift4/ose-apiserver-network-proxy-rhel8, openshift4/ose-hypershift-rhel8 +1
  • RHSA-2024:6811 Released 2024-09-25 · Red Hat rating Important
    OpenShift Container Platform 4.13.51 bug fix and security update
    • Red Hat OpenShift Container Platform 4.13 openshift4/ose-cluster-openshift-controller-manager-operator, openshift4/ose-hypershift-rhel8, openshift4/ose-openshift-apiserver-rhel8 +1
  • RHSA-2024:6637 Released 2024-09-18 · Red Hat rating Moderate
    OpenShift Container Platform 4.15.32 bug fix and security update
    • Red Hat OpenShift Container Platform 4.15 openshift4/ose-vsphere-cloud-controller-manager-rhel9
  • RHSA-2024:6632 Released 2024-09-17 · Red Hat rating Moderate
    OpenShift Container Platform 4.16.12 security update
    • Red Hat OpenShift Container Platform 4.16 openshift4/ose-vsphere-cloud-controller-manager-rhel9
  • RHSA-2024:6406 Released 2024-09-11 · Red Hat rating Important
    OpenShift Container Platform 4.14.36 security update
    • Red Hat OpenShift Container Platform 4.14 openshift4/cloud-network-config-controller-rhel8, openshift4/driver-toolkit-rhel9, openshift4/egress-router-cni-rhel8 +47
  • RHSA-2024:6409 Released 2024-09-11 · Red Hat rating Moderate
    OpenShift Container Platform 4.15.31 bug fix and security update
    • Red Hat OpenShift Container Platform 4.15 openshift4/ose-apiserver-network-proxy-rhel9, openshift4/ose-hypershift-rhel9, openshift4/ose-ibm-cloud-controller-manager-rhel9
  • RHSA-2024:6236 Released 2024-09-03 · Red Hat rating Moderate
    Red Hat Advanced Cluster Management 2.10.5 security and bug fix update
    • Red Hat Advanced Cluster Management for Kubernetes 2.10 for RHEL 9 rhacm2/acm-cluster-permission-rhel9, rhacm2/acm-governance-policy-addon-controller-rhel9, rhacm2/acm-governance-policy-framework-addon-rhel9 +41
  • RHSA-2024:5433 Released 2024-08-22 · Red Hat rating Important
    OpenShift Container Platform 4.14.35 security update
    • Red Hat OpenShift Container Platform 4.14 openshift4/cloud-network-config-controller-rhel8, openshift4/driver-toolkit-rhel9, openshift4/egress-router-cni-rhel8 +47
  • RHSA-2024:4591 Released 2024-07-17 · Red Hat rating Important
    Red Hat OpenShift Data Foundation 4.16.0 security, enhancement & bug fix update
    • RHODF 4.16 for RHEL 9 odf4/cephcsi-rhel9, odf4/mcg-core-rhel9, odf4/mcg-operator-bundle +8
  • RHSA-2024:0041 Released 2024-06-27 · Red Hat rating Critical
    OpenShift Container Platform 4.16.0 bug fix and security update
    • Red Hat OpenShift Container Platform 4.16 openshift4/aws-kms-encryption-provider-rhel9, openshift4/azure-kms-encryption-provider-rhel9, openshift4/cloud-network-config-controller-rhel9 +47
  • RHSA-2024:2865 Released 2024-05-21 · Red Hat rating Important
    OpenShift Container Platform 4.15.14 bug fix and security update
    • Red Hat OpenShift Container Platform 4.15 openshift4/ose-aws-pod-identity-webhook-rhel9, openshift4/ose-azure-cloud-node-manager-rhel9, openshift4/ose-azure-cluster-api-controllers-rhel9 +3
  • RHSA-2024:2773 Released 2024-05-15 · Red Hat rating Important
    OpenShift Container Platform 4.15.13 bug fix and security update
    • Red Hat OpenShift Container Platform 4.15 openshift4/ose-agent-installer-node-agent-rhel9, openshift4/ose-azure-workload-identity-webhook-rhel8, openshift4/ose-cluster-api-rhel9 +3
  • RHSA-2024:1891 Released 2024-04-26 · Red Hat rating Important
    OpenShift Container Platform 4.14.22 bug fix and security update
    • Red Hat OpenShift Container Platform 4.14 openshift4/cloud-network-config-controller-rhel8, openshift4/driver-toolkit-rhel9, openshift4/egress-router-cni-rhel8 +47
  • RHSA-2024:1887 Released 2024-04-25 · Red Hat rating Important
    OpenShift Container Platform 4.15.10 bug fix and security update
    • Red Hat OpenShift Container Platform 4.15 openshift4/oc-mirror-plugin-rhel9, openshift4/ose-cluster-monitoring-rhel9-operator, openshift4/ose-kubevirt-cloud-controller-manager-rhel9
  • RHSA-2024:1812 Released 2024-04-15 · Red Hat rating Moderate
    Custom Metrics Autoscaler Operator for Red Hat OpenShift 2.12.1-376 Bug Fixes
    • OpenShift Custom Metrics Autoscaler 2 custom-metrics-autoscaler/custom-metrics-autoscaler-adapter-rhel8, custom-metrics-autoscaler/custom-metrics-autoscaler-admission-webhooks-rhel8, custom-metrics-autoscaler/custom-metrics-autoscaler-operator-bundle +2
  • RHSA-2024:1449 Released 2024-03-27 · Red Hat rating Important
    OpenShift Container Platform 4.15.5 bug fix and security update
    • Red Hat OpenShift Container Platform 4.15 openshift4/ose-kubevirt-cloud-controller-manager-rhel9, openshift4/ose-operator-registry-rhel9
  • RHSA-2024:1458 Released 2024-03-27 · Red Hat rating Important
    OpenShift Container Platform 4.14.18 bug fix and security update
    • Red Hat OpenShift Container Platform 4.14 openshift4/ose-hypershift-rhel8, openshift4/ose-kubevirt-cloud-controller-manager-rhel8, openshift4/ose-operator-registry
  • RHSA-2024:1328 Released 2024-03-14 · Red Hat rating Moderate
    Red Hat Advanced Cluster Management 2.9.3 security and bug fix container updates
    • Red Hat Advanced Cluster Management for Kubernetes 2.9 for RHEL 8 rhacm2/acm-governance-policy-addon-controller-rhel8
  • RHSA-2024:0766 Released 2024-02-28 · Red Hat rating Critical
    OpenShift Container Platform 4.15.0 security update
    • Red Hat OpenShift Container Platform 4.15 openshift4/ose-aws-efs-csi-driver-container-rhel8, openshift4/ose-aws-efs-csi-driver-rhel8-operator, openshift4/ose-ptp-rhel9-operator
  • RHSA-2023:7198 Released 2024-02-27 · Red Hat rating Critical
    OpenShift Container Platform 4.15.0 bug fix and security update
    • Red Hat OpenShift Container Platform 4.15 openshift4/cloud-network-config-controller-rhel8, openshift4/egress-router-cni-rhel8, openshift4/kube-metrics-server-rhel8 +47
  • RHSA-2023:7197 Released 2024-02-27 · Red Hat rating Critical
    OpenShift Container Platform 4.15.0 security and extras update
    • Red Hat OpenShift Container Platform 4.15 openshift4/ose-ansible-operator, openshift4/ose-clusterresourceoverride-rhel9, openshift4/ose-clusterresourceoverride-rhel9-operator +7
  • RHSA-2024:0741 Released 2024-02-14 · Red Hat rating Critical
    OpenShift Container Platform 4.13.33 bug fix and security update
    • Red Hat OpenShift Container Platform 4.13 openshift4/egress-router-cni-rhel8, openshift4/ose-aws-cloud-controller-manager-rhel8, openshift4/ose-cluster-authentication-operator +3
  • RHSA-2024:0642 Released 2024-02-07 · Red Hat rating Critical
    OpenShift Container Platform 4.14.11 bug fix and security update
    • Red Hat OpenShift Container Platform 4.14 openshift4/ose-aws-cloud-controller-manager-rhel8, openshift4/ose-azure-cluster-api-controllers-rhel8, openshift4/ose-cluster-api-rhel8 +7
  • RHSA-2024:0489 Released 2024-01-31 · Red Hat rating Moderate
    OpenShift Container Platform 4.12.48 packages and security update
    • Red Hat OpenShift Container Platform 4.12 cri-o-1.25.5-6.rhaos4.12.gitfcf6ef3.el8
  • RHSA-2024:0288 Released 2024-01-24 · Red Hat rating Moderate
    OpenShift Container Platform 4.13.30 security update
    • Red Hat OpenShift Container Platform 4.13 cri-o-1.26.4-9.1.rhaos4.13.gite26e057.el8, cri-o-1.26.4-9.1.rhaos4.13.gite26e057.el9
  • RHSA-2024:0207 Released 2024-01-17 · Red Hat rating Moderate
    OpenShift Container Platform 4.14.9 packages and security update
    • Red Hat OpenShift Container Platform 4.14 cri-o-1.27.2-7.rhaos4.14.git1cc7a64.el8, cri-o-1.27.2-7.rhaos4.14.git1cc7a64.el9
  • RHSA-2024:0204 Released 2024-01-17 · Red Hat rating Moderate
    OpenShift Container Platform 4.14.9 bug fix and security update
    • Red Hat OpenShift Container Platform 4.14 openshift4/ose-openstack-cinder-csi-driver-rhel8-operator
  • RHSA-2023:7831 Released 2024-01-03 · Red Hat rating Important
    OpenShift Container Platform 4.14.7 bug fix and security update
    • Red Hat OpenShift Container Platform 4.14 openshift4/ose-cluster-network-operator, openshift4/ose-ibm-cloud-controller-manager-rhel8, openshift4/ose-operator-registry +4
  • RHSA-2023:7681 Released 2023-12-12 · Red Hat rating Important
    OpenShift Container Platform 4.14.6 security and extras update
    • Red Hat OpenShift Container Platform 4.14 openshift4/nmstate-console-plugin-rhel8, openshift4/ose-clusterresourceoverride-rhel8, openshift4/ose-clusterresourceoverride-rhel8-operator +1

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Logical Volume Manager StorageAffectedNo fix yet
Multicluster Engine for KubernetesAffectedNo fix yet
Red Hat Ceph Storage 7AffectedNo fix yet
Red Hat Enterprise Linux 10AffectedNo fix yet
Red Hat Enterprise Linux 8AffectedNo fix planned: Will not fix
Red Hat OpenShift Container Platform 4AffectedNo fix yet
Red Hat OpenShift GitOpsAffectedNo fix planned: Will not fix
Red Hat OpenShift distributed tracing 3AffectedNo fix yet
Red Hat Openshift Sandboxed ContainersAffectedNo fix yet
OpenShift Custom Metrics Autoscaler 2Fixed RHSA-2024:1812
RHODF 4.16 for RHEL 9Fixed RHSA-2024:4591
Red Hat Advanced Cluster Management for Kubernetes 2.10 for RHEL 9Fixed RHSA-2024:6236
Red Hat Advanced Cluster Management for Kubernetes 2.9 for RHEL 8Fixed RHSA-2024:1328
Red Hat OpenShift Container Platform 4.12Fixed RHSA-2024:0489
Red Hat OpenShift Container Platform 4.13Fixed RHSA-2024:0288, RHSA-2024:0741, RHSA-2024:6811
Red Hat OpenShift Container Platform 4.14Fixed RHSA-2023:7681, RHSA-2023:7831, RHSA-2024:0204, RHSA-2024:0207, RHSA-2024:0642, RHSA-2024:1458, RHSA-2024:1891, RHSA-2024:5433, RHSA-2024:6406, RHSA-2024:7184, RHSA-2024:8235, RHSA-2025:0029
Red Hat OpenShift Container Platform 4.15Fixed RHSA-2023:7197, RHSA-2023:7198, RHSA-2024:0766, RHSA-2024:1449, RHSA-2024:1887, RHSA-2024:2773, RHSA-2024:2865, RHSA-2024:6409, RHSA-2024:6637
Red Hat OpenShift Container Platform 4.16Fixed RHSA-2024:0041, RHSA-2024:6632
multicluster engine for Kubernetes 2.6 for RHEL 8Fixed RHSA-2024:11293
multicluster engine for Kubernetes 2.6 for RHEL 9Fixed RHSA-2024:11293
multicluster engine for Kubernetes 2.7 for RHEL 8Fixed RHSA-2024:10857
multicluster engine for Kubernetes 2.7 for RHEL 9Fixed RHSA-2024:10857
Not affected: 24 products
  • Kube Descheduler Operator
  • OpenShift API for Data Protection
  • OpenShift Pipelines
  • OpenShift Run Once Duration Override Operator
  • OpenShift Secondary Scheduler Operator
  • OpenShift Serverless
  • RHODF 4.16 for RHEL 9
  • Red Hat Advanced Cluster Management for Kubernetes 2.9 for RHEL 8
  • Red Hat Ceph Storage 5
  • Red Hat Ceph Storage 6
  • Red Hat Enterprise Linux 10
  • Red Hat Enterprise Linux 8
  • Red Hat Enterprise Linux 9
  • Red Hat OpenShift Container Platform 4
  • Red Hat OpenShift Container Platform 4.12
  • Red Hat OpenShift Container Platform 4.13
  • Red Hat OpenShift Container Platform 4.14
  • Red Hat OpenShift Container Platform 4.15
  • Red Hat OpenShift Container Platform 4.16
  • Red Hat OpenShift Data Science (RHODS)
  • Red Hat OpenShift distributed tracing 2
  • Red Hat OpenShift distributed tracing 3
  • Red Hat Openshift Data Foundation 4
  • cert-manager Operator for Red Hat OpenShift

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-47108
  2. 2026-10-03 Alias added: GHSA-8pgv-569h-w5rw

References

Patch 2

Advisory 2

Other 5

  • TI-2026-23298 OpenTelemetry-Go multi-value `baggage` header extraction causes excessive allocations (remote dos amplification) CVSS 3.1HIGH 7.5
  • TI-2026-29801 OpenTelemetry-Go's baggage parsing no longer caps raw header length CVSS 3.1MEDIUM 5.3
  • TI-2026-32829 opentelemetry-cpp: OTLP HTTP exporters read unbounded HTTP response CVSS 3.1MEDIUM 5.3
  • TI-2023-23498 opentelemetry-instrumentation Denial of Service vulnerability due to unbound cardinality metrics CVSS 3.1HIGH 7.5
  • TI-2023-24163 OpenTelemetry-Go Contrib has DoS vulnerability in otelhttp due to unbound cardinality metrics CVSS 3.1HIGH 7.5
  • TI-2026-28762 Untrusted search path in open-telemetry opentelemetry-go CVSS 4.0HIGH 7.3
See all 13 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences