Vendor
Opentelemetry
36 known vulnerabilities in products by Opentelemetry, 0 of them actively exploited (CISA KEV).
Key figures
36
Vulnerabilities
0
Actively exploited (KEV)
0
Used by ransomware
0
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| High | CVE-2023-47108 | DoS vulnerability in otelgrpc (uncontrolled resource consumption) due to unbound cardinality metrics | 7.5 | |
| High | CVE-2023-45142 | OpenTelemetry-Go Contrib has DoS vulnerability in otelhttp due to unbound cardinality metrics | 7.5 | |
| High | CVE-2024-36129 | OpenTelemetry Collector has a Denial of Service via Zip/Decompression Bomb sent over HTTP or gRPC | 8.2 | |
| High | CVE-2026-29181 | Opentelemetry-go: Allocation of Resources Without Limits or Throttling | 7.5 | |
| High | CVE-2026-112006 | Opentelemetry-exporter-otlp-proto-http: Improper Certificate Validation | 6.5 | |
| High | CVE-2026-44902 | opentelemetry-js: Prometheus exporter process crash via malformed HTTP request | 7.5 | |
| High | CVE-2026-45685 | OpenTelemetry eBPF Instrumentation: MongoDB parser panics on malformed wire messages | 7.5 | |
| High | CVE-2023-43810 | opentelemetry-instrumentation Denial of Service vulnerability due to unbound cardinality metrics | 7.5 | |
| High | CVE-2026-45686 | OpenTelemetry eBPF Instrumentation: Memcached payload length overflow can crash OBI | 7.5 | |
| High | CVE-2026-45678 | OpenTelemetry eBPF Instrumentation: Postgres BIND parsing can panic on malformed payloads | 7.5 | |
| Medium | CVE-2026-104872 | @opentelemetry Instrumentation-cassandra-driver: Insertion of Sensitive Information into Log File | 5.8 | |
| High | CVE-2026-42348 | OpAMP client reads unbounded HTTP response bodies | 7.5 | |
| High | CVE-2026-41433 | Opentelemetry-ebpf-instrumentation: Path Traversal | 8.4 | |
| High | CVE-2026-42602 | Opentelemetry-collector-contrib: Observable Timing Discrepancy | 8.1 | |
| High | CVE-2026-42191 | Opentelemetry-dotnet: Creation of Temporary File in Directory with Insecure Permissions | 7.8 | |
| Medium | CVE-2026-40894 | OpenTelemetry dotnet: Excessive memory allocation when parsing OpenTelemetry propagation headers | 5.3 | |
| Medium | CVE-2026-54285 | opentelemetry-js: Unbounded memory allocation in W3C Baggage propagation | 5.3 | |
| High | CVE-2026-39883 | Opentelemetry-go: Untrusted Search Path | 7.0 | |
| High | CVE-2026-45680 | OpenTelemetry eBPF Instrumentation: Unbounded BPF internal metrics replay can exhaust CPU | 5.9 | |
| Medium | CVE-2026-41484 | Opentelemetry-dotnet-contrib: Allocation of Resources Without Limits or Throttling | 5.9 | |
| Medium | CVE-2026-45679 | OpenTelemetry eBPF Instrumentation: Redis error text is exported in span status messages | 6.5 | |
| Medium | CVE-2026-41483 | Unbounded HTTP response body read in OpenTelemetry.Resources.Azure | 5.9 | |
| Medium | CVE-2026-45681 | OpenTelemetry eBPF Instrumentation: CPU-mismatch fallback uses 256-byte buffer with 8KB size | 5.9 | |
| Medium | CVE-2026-41178 | OpenTelemetry-Go's baggage parsing no longer caps raw header length | 5.3 | |
| Medium | CVE-2026-40182 | OpenTelemetry dotnet: OTLP exporter reads unbounded HTTP response bodies | 5.9 |
Products
| OpenTelemetry | 14 | 0 |
| Ebpf Instrumentation | 10 | 0 |