Skip to content
Threat Feed
Subscribe

Tag

Opentelemetry

6 briefs RSS
low advisory

CVE-2026-59892: OpenTelemetry JaegerPropagator Denial of Service

A critical denial of service vulnerability, CVE-2026-59892, exists in `@opentelemetry/propagator-jaeger` versions prior to 2.9.0, allowing an unauthenticated remote attacker to terminate Node.js applications configured with `JaegerPropagator` by sending a malformed percent-encoded value in `uber-trace-id` or `uberctx-*` HTTP headers, leading to an uncaught `URIError`.

@opentelemetry/propagator-jaeger denial-of-service vulnerability javascript nodejs opentelemetry
1t 1c
medium advisory

OpenTelemetry eBPF Instrumentation (OBI) Memcached Integer Overflow DoS

A remotely reachable integer overflow in OpenTelemetry eBPF Instrumentation's (OBI) memcached text protocol parser can crash the OBI process, causing a denial of service due to unchecked arithmetic when handling large payload sizes in memcached storage commands.

go.opentelemetry.io/obi denial-of-service integer-overflow memcached opentelemetry
1r 2t
medium threat

OpenTelemetry eBPF Instrumentation MongoDB Parser Denial-of-Service

Malformed MongoDB wire messages can trigger uncaught panics in the OpenTelemetry eBPF Instrumentation agent's MongoDB TCP parser, allowing a remote unauthenticated attacker to crash the telemetry agent and cause a denial of service.

go.opentelemetry.io/obi opentelemetry mongodb denial-of-service CVE-2026-45685
2r 1t
high advisory

OpenTelemetry Collector Azure Auth Extension Authentication Bypass

A server-side authentication bypass vulnerability exists in opentelemetry-collector-contrib's azureauthextension versions 0.124.0 through 0.150.0, allowing attackers with a valid Azure access token to authenticate to any OpenTelemetry receiver that uses `auth: azure_auth` due to improper JWT validation.

opentelemetry-collector-contrib +3 authentication-bypass opentelemetry azure jwt
2r 1t
medium advisory

OpenTelemetry-Go Multi-Value Baggage Header Extraction DoS Vulnerability (CVE-2026-29181)

A vulnerability in OpenTelemetry-Go related to the extraction of multi-value baggage headers can lead to excessive resource allocation, resulting in a remote denial-of-service amplification.

OpenTelemetry-Go dos opentelemetry cve-2026-29181
2r 1t 1c
critical advisory

OpenTelemetry RMI Instrumentation Unsafe Deserialization RCE

A remote code execution vulnerability exists in OpenTelemetry Java agent versions prior to 2.26.1 due to unsafe deserialization in the RMI instrumentation, potentially allowing attackers with network access to execute arbitrary code on vulnerable systems.

OpenTelemetry Java agent rce opentelemetry deserialization
2r 1t