Read the docs
TI-2026-29796 Aliases CVE-2026-41173GHSA-28xm-prxc-5866

Unbounded HTTP response body read in OpenTelemetry.Sampler.AWS

Priority LOW 26CWE-770Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-770.

Summary

The AWS X-Ray Remote Sampler package provides a sampler which can get sampling configurations from AWS X-Ray. Prior to 0.1.0-alpha.8, OpenTelemetry.Sampler.AWS reads unbounded HTTP response bodies from a configured AWS X-Ray remote sampling endpoint into memory. AWSXRaySamplerClient.DoRequestAsync called HttpClient.SendAsync followed by ReadAsStringAsync(), which materializes the entire HTTP response body into a single in-memory string with no size limit. The sampling endpoint is configurable via AWSXRayRemoteSamplerBuilder.SetEndpoint (default: http://localhost:2000). An attacker who controls the configured endpoint, or who can intercept traffic to it (MitM), can return an arbitrarily large response body. This causes unbounded heap allocation in the consuming process, leading to high transient memory pressure, garbage-collection stalls, or an OutOfMemoryException that terminates the process. This vulnerability is fixed in 0.1.0-alpha.8.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00301 23rd percentileScored 2026-11-07
Fix Fixed opentelemetry-dotnet-contrib (open-telemetry): 0.1.0-alpha.8OpenTelemetry.Sampler.AWS (NuGet): 0.1.0-alpha.8+1 more product

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
open-telemetryopentelemetry-dotnet-contribbefore 0.1.0-alpha.80.1.0-alpha.8Patch availableCNA
—OpenTelemetry.Sampler.AWS (NuGet)before 0.1.0-alpha.80.1.0-alpha.8Patch availableGHSA-28xm-prxc-5866
—OpenTelemetry.Resources.AWS (NuGet)before 1.15.11.15.1Patch availableGHSA-28xm-prxc-5866
  • opentelemetry-dotnet-contrib Vendoropen-telemetry Affected before 0.1.0-alpha.8 Fixed in 0.1.0-alpha.8 Patch available CNA
  • OpenTelemetry.Sampler.AWS (NuGet) Vendor— Affected before 0.1.0-alpha.8 Fixed in 0.1.0-alpha.8 Patch available GHSA-28xm-prxc-5866
  • OpenTelemetry.Resources.AWS (NuGet) Vendor— Affected before 1.15.1 Fixed in 1.15.1 Patch available GHSA-28xm-prxc-5866

Remediation

  • Fix · CNA opentelemetry-dotnet-contrib (open-telemetry) Fixed in 0.1.0-alpha.8
  • Fix · GHSA-28xm-prxc-5866 OpenTelemetry.Sampler.AWS (NuGet) Fixed in 0.1.0-alpha.8 Advisory →
  • Fix · GHSA-28xm-prxc-5866 OpenTelemetry.Resources.AWS (NuGet) Fixed in 1.15.1 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-41173
  2. 2026-10-03 Alias added: GHSA-28xm-prxc-5866

References

Advisory 1

Other 4

  • TI-2024-23957 OpenTelemetry Collector has a Denial of Service via Zip/Decompression Bomb sent over HTTP or gRPC CVSS 3.1HIGH 8.2
  • TI-2026-42706 OpenTelemetry JavaScript: Denial of service in `JaegerPropagator` via unhandled exception on a malformed header CVSS 3.1HIGH 7.5
  • TI-2026-33428 OpenTelemetry eBPF Instrumentation: Memcached payload length overflow can crash OBI CVSS 3.1HIGH 7.5
  • TI-2026-33427 OpenTelemetry eBPF Instrumentation: MongoDB parser panics on malformed wire messages CVSS 3.1HIGH 7.5
  • TI-2026-33420 OpenTelemetry eBPF Instrumentation: Postgres BIND parsing can panic on malformed payloads CVSS 3.1HIGH 7.5
  • TI-2026-32777 opentelemetry-js: Prometheus exporter process crash via malformed HTTP request CVSS 3.1HIGH 7.5
See all 62 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences