Read the docs
TI-2026-32829 Aliases CVE-2026-44967

opentelemetry-cpp: OTLP HTTP exporters read unbounded HTTP response

Priority MEDIUM 57CWE-789Published · Updated

Key facts

Attack vector
Adjacent network
Privileges required
None
User interaction
None
Attack complexity
High
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 1 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-789.

Summary

OpenTelemetry-cpp is the C++ implementation of OpenTelemetry. Prior to release 1.27.0, the OTLP HTTP exporters (traces/metrics/logs) read the full HTTP response into an in-memory vector of bytes without a size cap. This is exploitable for memory exhaustion when the configured collector endpoint is attacker-controlled (or a network attacker can MITM the exporter connection). This vulnerability is fixed in opentelemetry-cpp release 1.27.0.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00206 10th percentileScored 2026-11-07
Fix Partial opentelemetry-cpp (open-telemetry): 1.27.0Red Hat: 1 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
open-telemetryopentelemetry-cppbefore 1.27.01.27.0Patch availableCNA
  • opentelemetry-cpp Vendoropen-telemetry Affected before 1.27.0 Fixed in 1.27.0 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:opentelemetry:opentelemetry:*:*:*:*:*:c\+\+:*:*before 1.27.0Vulnerableopen-telemetry
  • cpe:2.3:a:opentelemetry:opentelemetry:*:*:*:*:*:c\+\+:*:* Versions before 1.27.0 Vulnerable ·open-telemetry

Remediation

  • Fix · CNA opentelemetry-cpp (open-telemetry) Fixed in 1.27.0

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat AMQ ClientsAffectedNo fix yet: Fix deferred
Not affected: 4 products
  • Red Hat Enterprise Linux 10
  • Red Hat Enterprise Linux 7
  • Red Hat Enterprise Linux 8
  • Red Hat Enterprise Linux 9

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-44967

References

Advisory 2

Other 2

  • TI-2026-23298 OpenTelemetry-Go multi-value `baggage` header extraction causes excessive allocations (remote dos amplification) CVSS 3.1HIGH 7.5
  • TI-2023-25448 DoS vulnerability in otelgrpc (uncontrolled resource consumption) due to unbound cardinality metrics CVSS 3.1HIGH 7.5
  • TI-2026-29801 OpenTelemetry-Go's baggage parsing no longer caps raw header length CVSS 3.1MEDIUM 5.3
  • TI-2023-23498 opentelemetry-instrumentation Denial of Service vulnerability due to unbound cardinality metrics CVSS 3.1HIGH 7.5
  • TI-2023-24163 OpenTelemetry-Go Contrib has DoS vulnerability in otelhttp due to unbound cardinality metrics CVSS 3.1HIGH 7.5
  • TI-2026-28762 Untrusted search path in open-telemetry opentelemetry-go CVSS 4.0HIGH 7.3
See all 13 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences