Advisory Database
  • Advisories
  • Dependency Scanning
  1. nuget
  2. ›
  3. OpenTelemetry.OpAmp.Client
  4. ›
  5. CVE-2026-42348

CVE-2026-42348: OpAMP client reads unbounded HTTP response bodies

May 5, 2026

When receiving responses from the OpAMP server over HTTP, the OpAMP client allocates an unbounded buffer to read all bytes from the server, with no upper-bound on the number of bytes consumed.

This could cause memory exhaustion in the consuming application if the configured OpAMP server is attacker-controlled (or a network attacker can MitM the connection) and an extremely large body is returned in the response.

References

  • github.com/advisories/GHSA-w2jh-77fq-7gp8
  • github.com/open-telemetry/opentelemetry-dotnet-contrib
  • github.com/open-telemetry/opentelemetry-dotnet-contrib/commit/bf1fad4fa298ff451cda0efb0ee9c7a7eb46212a
  • github.com/open-telemetry/opentelemetry-dotnet-contrib/pull/4116
  • github.com/open-telemetry/opentelemetry-dotnet-contrib/security/advisories/GHSA-w2jh-77fq-7gp8
  • nvd.nist.gov/vuln/detail/CVE-2026-42348

Code Behaviors & Features

Detect and mitigate CVE-2026-42348 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →

Affected versions

All versions before 0.2.0-alpha.1

Fixed versions

  • 0.2.0-alpha.1

Solution

Upgrade to version 0.2.0-alpha.1 or above.

Impact 5.9 MEDIUM

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Learn more about CVSS

Weakness

  • CWE-789: Memory Allocation with Excessive Size Value

Source file

nuget/OpenTelemetry.OpAmp.Client/CVE-2026-42348.yml

Spotted a mistake? Edit the file on GitLab.

  • Site Repo
  • About GitLab
  • Terms
  • Privacy Statement
  • Contact

Page generated Sat, 09 May 2026 00:20:49 +0000.