Skip to content
Noroxi

OpenTelemetry records

37 published records for vendor opentelemetry.

Researcher profile

Entered KEV
0 · 0%
Weaponized
0 · 0%
Pre-auth RCE
0
With a fix record
97.3%
Median publish → KEV
No record has entered KEV

Records by year

  1. 23
  2. 24
  3. 26

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

CWE

Attack profile

All records

37 records
  • CVE-2026-41433
    33Monitor

    OpenTelemetry eBPF Instrumentation: Privileged Java agent injection allows arbitrary host file overwrite via untrusted TMPDIR

    HighCVSS 8.4No exploitEPSS 0%

    opentelemetry · opentelemetry ebpf instrumentationApr 24, 2026

  • CVE-2026-42602
    32Monitor

    azureauthextension Authenticate method does not validate bearer tokens, allowing auth bypass via replay

    HighCVSS 8.1No exploitEPSS 0%

    opentelemetry · opentelemetry collector contribMay 13, 2026

  • CVE-2023-47108
    31Monitor

    DoS vulnerability in otelgrpc (uncontrolled resource consumption) due to unbound cardinality metrics

    HighCVSS 7.5Proof of conceptEPSS 2%

    opentelemetry · opentelemetryNov 10, 2023

  • CVE-2026-42191
    31Monitor

    OpenTelemetry.Exporter.OpenTelemetryProtocol: Disk retry default temp path enables local blob injection for OTLP Exporter

    HighCVSS 7.8No exploitEPSS 0%

    opentelemetry · opentelemetry.exporter.opentelemetryprotocolMay 12, 2026

  • CVE-2023-45142
    30Monitor

    OpenTelemetry-Go Contrib has DoS vulnerability in otelhttp due to unbound cardinality metrics

    HighCVSS 7.5No exploitEPSS 1%

    opentelemetry · opentelemetryOct 12, 2023

  • CVE-2024-36129
    30Monitor

    OpenTelemetry Collector has a Denial of Service via Zip/Decompression Bomb sent over HTTP or gRPC

    HighCVSS 7.5No exploitEPSS 1%

    opentelemetry · configgrpcJun 5, 2024

  • CVE-2026-29181
    30Monitor

    OpenTelemetry-Go multi-value `baggage` header extraction causes excessive allocations (remote dos amplification)

    HighCVSS 7.5No exploitEPSS 0%

    opentelemetry · opentelemetryApr 7, 2026

  • CVE-2023-43810
    30Monitor

    opentelemetry-instrumentation Denial of Service vulnerability due to unbound cardinality metrics

    HighCVSS 7.5No exploitEPSS 0%

    opentelemetry · opentelemetryOct 6, 2023

  • CVE-2026-45685
    30Monitor

    OpenTelemetry eBPF Instrumentation: MongoDB parser panics on malformed wire messages

    HighCVSS 7.5No exploitEPSS 0%

    opentelemetry · ebpf instrumentationJun 2, 2026

  • CVE-2026-45678
    30Monitor

    OpenTelemetry eBPF Instrumentation: Postgres BIND parsing can panic on malformed payloads

    HighCVSS 7.5No exploitEPSS 0%

    opentelemetry · ebpf instrumentationJun 2, 2026

  • CVE-2026-45686
    30Monitor

    OpenTelemetry eBPF Instrumentation: Memcached payload length overflow can crash OBI

    HighCVSS 7.5No exploitEPSS 0%

    opentelemetry · ebpf instrumentationJun 2, 2026

  • CVE-2026-44902
    30Monitor

    opentelemetry-js: Prometheus exporter process crash via malformed HTTP request

    HighCVSS 7.5No exploitEPSS 0%

    opentelemetry · opentelemetry\/auto-instrumentations-nodeMay 27, 2026

  • CVE-2026-42348
    30Monitor

    OpAMP client reads unbounded HTTP response bodies

    HighCVSS 7.5No exploitEPSS 0%

    opentelemetry · opentelemetry.opamp.clientMay 12, 2026

  • CVE-2026-45680
    30Monitor

    OpenTelemetry eBPF Instrumentation: Unbounded BPF internal metrics replay can exhaust CPU

    HighCVSS 7.5No exploitEPSS 0%

    opentelemetry · ebpf instrumentationJun 2, 2026

  • CVE-2026-39883
    29Monitor

    OpenTelemetry-Go has an incomplete fix for CVE-2026-24051: BSD kenv command not using absolute path enables PATH hijacking

    HighCVSS 7.3No exploitEPSS 0%

    opentelemetry · opentelemetryApr 8, 2026

  • CVE-2026-24051
    28Monitor

    OpenTelemetry-Go Affected by Arbitrary Code Execution via PATH Hijacking

    HighCVSS 7.0No exploitEPSS 0%

    opentelemetry · opentelemetryFeb 2, 2026

  • CVE-2024-42368
    26Monitor

    open-telemetry has an Observable Timing Discrepancy

    MediumCVSS 6.5No exploitEPSS 0%

    open-telemetry · opentelemetry-collector-contribAug 13, 2024

  • CVE-2026-45679
    26Monitor

    OpenTelemetry eBPF Instrumentation: Redis error text is exported in span status messages

    MediumCVSS 6.5No exploitEPSS 0%

    opentelemetry · ebpf instrumentationJun 2, 2026

  • CVE-2026-40182
    23Monitor

    OpenTelemetry dotnet: OTLP exporter reads unbounded HTTP response bodies

    MediumCVSS 5.9No exploitEPSS 0%

    opentelemetry · opentelemetryApr 23, 2026

  • CVE-2026-41484
    23Monitor

    OpenTelemetry.Exporter.OneCollector vulnerable to denial of service via unbounded HTTP error response body

    MediumCVSS 5.9No exploitEPSS 0%

    opentelemetry · opentelemetry.exporter.onecollectorMay 6, 2026

  • CVE-2026-41483
    23Monitor

    Unbounded HTTP response body read in OpenTelemetry.Resources.Azure

    MediumCVSS 5.9No exploitEPSS 0%

    opentelemetry · opentelemetry.resources.azureMay 6, 2026

  • CVE-2026-41078
    23Monitor

    OpenTelemetry dotnet: Potential memory exhaustion via unbounded pooled-list sizing in Jaeger exporter conversion path

    MediumCVSS 5.9No exploitEPSS 0%

    opentelemetry · opentelemetryApr 23, 2026

  • CVE-2026-45681
    23Monitor

    OpenTelemetry eBPF Instrumentation: CPU-mismatch fallback uses 256-byte buffer with 8KB size

    MediumCVSS 5.9No exploitEPSS 0%

    opentelemetry · ebpf instrumentationJun 2, 2026

  • CVE-2026-45676
    22Monitor

    OpenTelemetry eBPF Instrumentation: Unsafe fastelf parsing allows malformed ELF to crash agent

    MediumCVSS 5.5No exploitEPSS 0%

    opentelemetry · ebpf instrumentationJun 2, 2026

  • CVE-2026-45682
    22Monitor

    OpenTelemetry eBPF Instrumentation: CappedConcurrentHashMap leaks keys after removals

    MediumCVSS 5.5No exploitEPSS 0%

    opentelemetry · ebpf instrumentationJun 2, 2026