CVE-2026-41483— Unbounded HTTP response body read in OpenTelemetry.Resources.Azure

Unbounded HTTP response body read in OpenTelemetry.Resources.Azure

OpenTelemetry.Resources.Azure is the .NET resource detector for Azure environments. In versions 1.15.0-beta.1 and earlier, the AzureVmMetaDataRequestor class makes HTTP requests to the Azure VM instance metadata service and reads the response body into memory without any size limit. An attacker who controls the configured endpoint, or who can intercept traffic to it via a man-in-the-middle attack, can return an arbitrarily large response body. This causes unbounded heap allocation in the consuming process, leading to high transient memory pressure, garbage-collection stalls, or an OutOfMemoryException that terminates the process. As a workaround, disable the Azure VM resource detector or use network-level controls such as firewall rules, mTLS, or a service mesh to prevent man-in-the-middle attacks on the Azure VM instance metadata endpoint. This issue is fixed in version 1.15.1-beta.1, which streams responses rather than buffering them entirely in memory and ignores responses larger than 4 MiB.

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

不加限制或调节的资源分配

OpenTelemetry 安全漏洞

OpenTelemetry是OpenTelemetry开源的一个供应商中立的开源可观测性框架。 OpenTelemetry 1.15.0-beta.1及之前版本存在安全漏洞，该漏洞源于AzureVmMetaDataRequestor类在读取响应体时无大小限制，可能导致堆分配无界增长，引发高内存压力或进程终止。

N/A

N/A