CVE-2026-44967: opentelemetry-cpp: OTLP HTTP exporters read unbounded HTTP response
OpenTelemetry-cpp is the C++ implementation of OpenTelemetry. Prior to release 1.27.0, the OTLP HTTP exporters (traces/metrics/logs) read the full HTTP response into an in-memory vector of bytes without a size cap. This is exploitable for memory exhaustion when the configured collector endpoint is attacker-controlled (or a network attacker can MITM the exporter connection). This vulnerability is fixed in opentelemetry-cpp release 1.27.0.
Other sources
opentelemetry-cpp: OTLP HTTP exporters read unbounded HTTP response
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.14.2-3 - Upgrade
Upgrade
opentelemetry-cppto a version that resolves this vulnerability.Fixed in 1.27.0
Event History
Frequently Asked Questions
What is the severity of CVE-2026-44967?
The severity of CVE-2026-44967 is medium with a score of 5.3.
What kind of vulnerability is identified in CVE-2026-44967?
CVE-2026-44967 is a memory exhaustion vulnerability caused by unbounded reading of HTTP responses.
How do I fix CVE-2026-44967?
To mitigate CVE-2026-44967, upgrade to OpenTelemetry-cpp version 1.27.0 or later.
What software is affected by CVE-2026-44967?
CVE-2026-44967 affects the OpenTelemetry-cpp implementation of the OpenTelemetry project.
What is the impact of CVE-2026-44967?
CVE-2026-44967 can lead to memory exhaustion when handling large HTTP responses.