CVE-2026-44967
Description
A flaw was found in opentelemetry-cpp. The OTLP HTTP exporters (traces/metrics/logs) read the full HTTP response into an in-memory vector of bytes without a size cap. This can be exploited by an attacker-controlled collector endpoint or a network attacker performing a Man-in-the-Middle (MITM) attack. Successful exploitation leads to memory exhaustion, resulting in a Denial of Service (DoS).
Statement
A memory exhaustion vulnerability was found in OpenTelemetry C++, a C++ implementation of the OpenTelemetry observability framework. In versions prior to 1.27.0, the OTLP HTTP exporters for traces, metrics, and logs read the full HTTP response into an in-memory vector of bytes without a size cap. An attacker who controls the configured collector endpoint, or who can perform a man-in-the-middle attack on the exporter connection, can return an arbitrarily large or infinite HTTP response, causing the exporter to allocate unbounded memory. This can lead to memory exhaustion and denial of service through process crashes or system resource exhaustion. This issue affects Red Hat AMQ Clients versions 2026.Q1 and 2026.Q3, which bundle OpenTelemetry C++ version 1.19.0.
Mitigation
This issue is fixed in OpenTelemetry C++ version 1.27.0. Red Hat will provide updated versions of AMQ Clients that include the fixed library version.
Until updates are available, administrators can reduce the risk of memory exhaustion attacks by implementing the following mitigations:
1. Configure OTLP HTTP exporters to use only trusted, validated collector endpoints. Ensure collector endpoints are under organizational control and cannot be modified by untrusted parties.
2. Use TLS/HTTPS for telemetry export connections and implement certificate pinning or strict certificate validation to prevent man-in-the-middle attacks.
3. Deploy telemetry collectors on isolated, trusted networks that are not accessible to potential attackers.
4. Implement system-level memory limits (cgroups, ulimits) for processes using OpenTelemetry exporters to contain the impact of memory exhaustion attacks.
5. Monitor memory usage of applications using OpenTelemetry exporters and configure alerts for unusual memory consumption patterns.
6. Consider using alternative export protocols (such as OTLP gRPC instead of OTLP HTTP) if they are supported by your collector infrastructure, as this vulnerability is specific to the HTTP implementation.
7. Upgrade to OpenTelemetry C++ 1.27.0 or later as soon as updated AMQ Clients packages are available from Red Hat.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 5.3 | 5.3 | 5.3 |
| Attack Vector | Adjacent Network | Adjacent Network | Adjacent Network |
| Attack Complexity | High | High | High |
| Privileges Required | None | None | None |
| User Interaction | None | None | None |
| Scope | Unchanged | Unchanged | Unchanged |
| Confidentiality | None | None | None |
| Integrity Impact | None | None | None |
| Availability Impact | High | High | High |
Vector
Red Hat: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
NVD: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
cve.org: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Understanding the Weakness (CWE)
Availability
Technical Impact: DoS: Resource Consumption (CPU); DoS: Resource Consumption (Memory); DoS: Resource Consumption (Other)
When allocating resources without limits, an attacker could prevent other systems, applications, or processes from accessing the same type of resource. It can be easy for an attacker to consume many resources by rapidly making many requests or causing larger resources to be used than is needed.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
