What’s Vulnerable › Vulnerabilities

CVE-2026-42348: OpAMP client reads unbounded HTTP response bodies

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-05-12 · updated 2026-10-26
• Weakness: CWE-789

Description

OpenTelemetry.OpAmp.Client is the OpAMP client for OpenTelemetry .NET. Prior to 0.2.0-alpha.1, when receiving responses from the OpAMP server over HTTP, the OpAMP client allocates an unbounded buffer to read all bytes from the server, with no upper-bound on the number of bytes consumed. This could cause memory exhaustion in the consuming application if the configured OpAMP server is attacker-controlled (or a network attacker can MitM the connection) and an extremely large body is returned in the response. This vulnerability is fixed in 0.2.0-alpha.1.

Affected products

• @opentelemetry Opentelemetry.Opamp.Client: before 0.2.0 — fixed in 0.2.0

How to fix

Upgrade to a fixed version: @opentelemetry Opentelemetry.Opamp.Client 0.2.0. Check the vendor advisory for mitigations.

References

• https://github.com/open-telemetry/opentelemetry-dotnet-contrib/pull/4116
• https://github.com/open-telemetry/opentelemetry-dotnet-contrib/security/advisories/GHSA-w2jh-77fq-7gp8

Get alerted when CVE-2026-42348 or the next vulnerability affects your stack