CVE-2026-44967 Details
Description
OpenTelemetry-cpp is the C++ implementation of OpenTelemetry. Prior to release 1.27.0, the OTLP HTTP exporters (traces/metrics/logs) read the full HTTP response into an in-memory vector of bytes without a size cap. This is exploitable for memory exhaustion when the configured collector endpoint is attacker-controlled (or a network attacker can MITM the exporter connection). This vulnerability is fixed in opentelemetry-cpp release 1.27.0.
A memory exhaustion vulnerability has been identified in the OpenTelemetry-C++ OTLP HTTP exporters for traces, metrics, and logs, prior to version 1.27.0. The issue arises because these exporters read the entire HTTP response into memory without any size limit. This behavior can be exploited to cause excessive memory usage, especially when the collector endpoint is controlled by an attacker or when a network attacker can intercept the exporter's connection. The vulnerability is similar to one previously reported in the OpenTelemetry-Go implementation.
Users are advised to upgrade to OpenTelemetry-C++ version 1.27.0, which addresses the vulnerability by implementing a response body size limit and avoiding unnecessary copies of the response data.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jun 12, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-w8rr-5gcm-pp58 | CISA-ADP | Not ApplicableVendor Advisory |
| https://github.com/open-telemetry/opentelemetry-cpp/issues/3958 | [email protected] | Issue Tracking |
| https://github.com/open-telemetry/opentelemetry-cpp/pull/4078 | [email protected] | Issue Tracking |
| https://github.com/open-telemetry/opentelemetry-cpp/security/advisories/GHSA-5qhm-4rfp-qqvj | [email protected] | Vendor Advisory |
| https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-w8rr-5gcm-pp58 | [email protected] | Not ApplicableVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-789 | Memory Allocation with Excessive Size Value | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| opentelemetry opentelemetry | < 1.27.0 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 16, 2026 | Initial Analysis | [email protected] |
| Jun 12, 2026 | CVE Modified | CISA-ADP |
| Jun 12, 2026 | New CVE Received | [email protected] |