TI-2026-30650 Aliases CVE-2026-42348 GHSA-w2jh-77fq-7gp8

OpAMP client reads unbounded HTTP response bodies

LOW 33CWE-789Published 2026-05-12 · Updated 2026-05-13

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Denial of service
Confidentiality · integrity · availability: None · None · High
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-789.

Summary

OpenTelemetry.OpAmp.Client is the OpAMP client for OpenTelemetry .NET. Prior to 0.2.0-alpha.1, when receiving responses from the OpAMP server over HTTP, the OpAMP client allocates an unbounded buffer to read all bytes from the server, with no upper-bound on the number of bytes consumed. This could cause memory exhaustion in the consuming application if the configured OpAMP server is attacker-controlled (or a network attacker can MitM the connection) and an extremely large body is returned in the response. This vulnerability is fixed in 0.2.0-alpha.1.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00311 24th percentileScored 2026-11-07

Fix Fixed opentelemetry-dotnet-contrib (open-telemetry): 0.2.0-alpha.1OpenTelemetry.OpAmp.Client (NuGet): 0.2.0-alpha.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
open-telemetry	opentelemetry-dotnet-contrib	before 0.2.0-alpha.1	0.2.0-alpha.1	Patch available	CNA
—	OpenTelemetry.OpAmp.Client (NuGet)	before 0.2.0-alpha.1	0.2.0-alpha.1	Patch available	GHSA-w2jh-77fq-7gp8

opentelemetry-dotnet-contrib Vendoropen-telemetry Affected before 0.2.0-alpha.1 Fixed in 0.2.0-alpha.1 Patch available CNA
OpenTelemetry.OpAmp.Client (NuGet) Vendor— Affected before 0.2.0-alpha.1 Fixed in 0.2.0-alpha.1 Patch available GHSA-w2jh-77fq-7gp8

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:opentelemetry:opentelemetry.opamp.client::::::.net::*	before 0.2.0	Vulnerable	open-telemetry

cpe:2.3:a:opentelemetry:opentelemetry.opamp.client:*:*:*:*:*:.net:*:* Versions before 0.2.0 Vulnerable ·open-telemetry

Remediation

Fix · CNA opentelemetry-dotnet-contrib (open-telemetry) Fixed in 0.2.0-alpha.1
Fix · GHSA-w2jh-77fq-7gp8 OpenTelemetry.OpAmp.Client (NuGet) Fixed in 0.2.0-alpha.1 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2026-42348
2026-10-03 Alias added: GHSA-w2jh-77fq-7gp8

References

Patch 1

https://github.com/open-telemetry/opentelemetry-dotnet-contrib/security/advisories/GHSA-w2jh-77fq-7gp8

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2026-42348

Other 3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences