Skip to content
Threat Feed
Subscribe

Vendor

OpenTelemetry

7 briefs RSS
low advisory

CVE-2026-59892: OpenTelemetry JaegerPropagator Denial of Service

A critical denial of service vulnerability, CVE-2026-59892, exists in `@opentelemetry/propagator-jaeger` versions prior to 2.9.0, allowing an unauthenticated remote attacker to terminate Node.js applications configured with `JaegerPropagator` by sending a malformed percent-encoded value in `uber-trace-id` or `uberctx-*` HTTP headers, leading to an uncaught `URIError`.

@opentelemetry/propagator-jaeger denial-of-service vulnerability javascript nodejs opentelemetry
1t 1c
medium advisory

OpenTelemetry eBPF Instrumentation (OBI) Memcached Integer Overflow DoS

A remotely reachable integer overflow in OpenTelemetry eBPF Instrumentation's (OBI) memcached text protocol parser can crash the OBI process, causing a denial of service due to unchecked arithmetic when handling large payload sizes in memcached storage commands.

go.opentelemetry.io/obi denial-of-service integer-overflow memcached opentelemetry
1r 2t
medium threat

OpenTelemetry eBPF Instrumentation MongoDB Parser Denial-of-Service

Malformed MongoDB wire messages can trigger uncaught panics in the OpenTelemetry eBPF Instrumentation agent's MongoDB TCP parser, allowing a remote unauthenticated attacker to crash the telemetry agent and cause a denial of service.

go.opentelemetry.io/obi opentelemetry mongodb denial-of-service CVE-2026-45685
2r 1t
medium advisory

OpenTelemetry eBPF Instrumentation Postgres Parser Vulnerable to Panic via Malformed BIND Payloads (CVE-2026-45678)

The OpenTelemetry eBPF Instrumentation (OBI) Postgres protocol parser is vulnerable to a remote availability issue - when processing BIND messages, the parser assumes payloads contain a valid NUL-terminated portal name; a crafted empty or unterminated payload can cause OBI to slice beyond the end of the captured buffer, triggering a runtime panic and crashing the agent.

go/go.opentelemetry.io/obi denial-of-service postgres ebpf CVE-2026-45678
2r 1t
medium advisory

OpenTelemetry Prometheus Exporter Denial-of-Service via Malformed HTTP Request (CVE-2026-44902)

A malformed HTTP request can crash any Node.js process running the OpenTelemetry JS Prometheus exporter. The metrics endpoint has no error handling around URL parsing, so a request with an invalid URI causes an uncaught `TypeError` that terminates the process, leading to a denial of service. Update `@opentelemetry/exporter-prometheus` and `@opentelemetry/sdk-node` to version **0.217.0** or later and `@opentelemetry/auto-instrumentations-node` to version **0.75.0** or later to remediate.

@opentelemetry/exporter-prometheus +2 denial-of-service otel prometheus CVE-2026-44902
2r 1t
high advisory

OpenTelemetry Collector Azure Auth Extension Authentication Bypass

A server-side authentication bypass vulnerability exists in opentelemetry-collector-contrib's azureauthextension versions 0.124.0 through 0.150.0, allowing attackers with a valid Azure access token to authenticate to any OpenTelemetry receiver that uses `auth: azure_auth` due to improper JWT validation.

opentelemetry-collector-contrib +3 authentication-bypass opentelemetry azure jwt
2r 1t
critical advisory

OpenTelemetry RMI Instrumentation Unsafe Deserialization RCE

A remote code execution vulnerability exists in OpenTelemetry Java agent versions prior to 2.26.1 due to unsafe deserialization in the RMI instrumentation, potentially allowing attackers with network access to execute arbitrary code on vulnerable systems.

OpenTelemetry Java agent rce opentelemetry deserialization
2r 1t