What’s Vulnerable › Vulnerabilities

CVE-2024-36129: OpenTelemetry Collector has a Denial of Service via Zip/Decompression Bomb sent over HTTP or gRPC

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.2% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2024-06-05 · updated 2026-06-17
• Weakness: CWE-119

Description

The OpenTelemetry Collector offers a vendor-agnostic implementation on how to receive, process and export telemetry data. An unsafe decompression vulnerability allows unauthenticated attackers to crash the collector via excessive memory consumption. OTel Collector version 0.102.1 fixes this issue. It is also fixed in the confighttp module version 0.102.0 and configgrpc module version 0.102.1.

Affected products

• @opentelemetry Configgrpc: before 0.102.1 — fixed in 0.102.1
• @opentelemetry Confighttp: before 0.102.0 — fixed in 0.102.0
• @opentelemetry Opentelemetry Collector: before 0.102.1 — fixed in 0.102.1

How to fix

Upgrade to a fixed version: @opentelemetry Configgrpc 0.102.1; @opentelemetry Confighttp 0.102.0; @opentelemetry Opentelemetry Collector 0.102.1. Check the vendor advisory for mitigations.

References

• https://github.com/open-telemetry/opentelemetry-collector/pull/10289
• https://github.com/open-telemetry/opentelemetry-collector/pull/10323
• https://github.com/open-telemetry/opentelemetry-collector/security/advisories/GHSA-c74f-6mfw-mm4v
• https://opentelemetry.io/blog/2024/cve-2024-36129
• https://github.com/open-telemetry/opentelemetry-collector/pull/10289
• https://github.com/open-telemetry/opentelemetry-collector/pull/10323
• https://github.com/open-telemetry/opentelemetry-collector/security/advisories/GHSA-c74f-6mfw-mm4v
• https://opentelemetry.io/blog/2024/cve-2024-36129

Get alerted when CVE-2024-36129 or the next vulnerability affects your stack