CVEvulnerability
CVE-2024-36129
7.5 HIGH
Official page ↗
- Status
- Modified
- Published
- 2024-06-05
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 8.2 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
- CVSS 3.1 ([email protected])
- 7.5 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- Weaknesses
- CWE-119
Description
The OpenTelemetry Collector offers a vendor-agnostic implementation on how to receive, process and export telemetry data. An unsafe decompression vulnerability allows unauthenticated attackers to crash the collector via excessive memory consumption. OTel Collector version 0.102.1 fixes this issue. It is also fixed in the confighttp module version 0.102.0 and configgrpc module version 0.102.1.
Affected configurations
• opentelemetry configgrpc (< 0.102.1)
• opentelemetry confighttp (< 0.102.0)
• opentelemetry opentelemetry collector (< 0.102.1)
Related
Weakness · CWE (1)
- CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer weakness
References
- https://github.com/open-telemetry/opentelemetry-collector/pull/10289 Patch
- https://github.com/open-telemetry/opentelemetry-collector/pull/10323 Patch
- https://github.com/open-telemetry/opentelemetry-collector/security/advisories/GHSA-c74f-6mfw-mm4v Exploit, Third Party Advisory
- https://opentelemetry.io/blog/2024/cve-2024-36129 Vendor Advisory
- https://github.com/open-telemetry/opentelemetry-collector/pull/10289 Patch
- https://github.com/open-telemetry/opentelemetry-collector/pull/10323 Patch
- https://github.com/open-telemetry/opentelemetry-collector/security/advisories/GHSA-c74f-6mfw-mm4v Exploit, Third Party Advisory
- https://opentelemetry.io/blog/2024/cve-2024-36129 Vendor Advisory