OpenTelemetry.OpAmp.Client is the OpAMP client for OpenTelemetry .NET. Prior to 0.2.0-alpha.1, when receiving responses from the OpAMP server over HTTP, the OpAMP client allocates an unbounded buffer to read all bytes from the server, with no upper-bound on the number of bytes consumed. This could cause memory exhaustion in the consuming application if the configured OpAMP server is attacker-controlled (or a network attacker can MitM the connection) and an extremely large body is returned in the response. This vulnerability is fixed in 0.2.0-alpha.1.
References
| Link | Resource |
|---|---|
| https://github.com/open-telemetry/opentelemetry-dotnet-contrib/pull/4116 | Issue Tracking |
| https://github.com/open-telemetry/opentelemetry-dotnet-contrib/security/advisories/GHSA-w2jh-77fq-7gp8 | Patch Vendor Advisory |
Configurations
History
27 May 2026, 15:57
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/open-telemetry/opentelemetry-dotnet-contrib/pull/4116 - Issue Tracking | |
| References | () https://github.com/open-telemetry/opentelemetry-dotnet-contrib/security/advisories/GHSA-w2jh-77fq-7gp8 - Patch, Vendor Advisory | |
| First Time |
Opentelemetry opentelemetry.opamp.client
Opentelemetry |
|
| CPE | cpe:2.3:a:opentelemetry:opentelemetry.opamp.client:*:*:*:*:*:.net:*:* |
12 May 2026, 18:17
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-05-12 18:17
Updated : 2026-05-27 15:57
NVD link : CVE-2026-42348
Mitre link : CVE-2026-42348
CVE.ORG link : CVE-2026-42348
JSON object : View
Products Affected
opentelemetry
- opentelemetry.opamp.client
CWE
CWE-789
Memory Allocation with Excessive Size Value