CVE-2023-43810CWE-400

opentelemetry-instrumentation Denial of Service vulnerability due to unbound cardinality metrics

High · published October 6, 2023

CVSS v3.1
7.5
EPSS
1%
Percentile
57.6
In the wild
Unconfirmed
What it is

OpenTelemetry, also known as OTel for short, is a vendor-neutral open-source Observability framework for instrumenting, generating, collecting, and exporting telemetry data such as traces, metrics, logs. Autoinstrumentation out of the box adds the label `http_method` that has unbound cardinality. It leads to the server's potential memory exhaustion when many malicious requests are sent. HTTP method for requests can be easily set by an attacker to be random and long. In order to be affected program has to be instrumented for HTTP handlers and does not filter any unknown HTTP methods on the level of CDN, LB, previous middleware, etc. This issue has been patched in version 0.41b0.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00845 · 57.6th percentile
Weakness
CWE-400 · Uncontrolled Resource Consumption
Published
2023-10-06T13:53Z
EPSS history
Timeline
  • 06 OCT 13:53Z
    opentelemetry-instrumentation Denial of Service vulnerability due to unbound cardinality metrics
    cvelistv5