An attacker who controls the configured endpoint, or who can intercept traffic to it via a man-in-the-middle attack, can return an arbitrarily large response body. This causes unbounded heap allocation in the consuming process, leading to high transient memory pressure, garbage-collection stalls, or an OutOfMemoryException that terminates the process. As a workaround, use network-level controls such as firewall rules, mTLS, or a service mesh to prevent man-in-the-middle attacks on the configured back-end or collector endpoint. This issue is fixed in version 1.15.1, which limits the number of bytes read from the response body in an error condition to 4 MiB.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| open-telemetry | opentelemetry-dotnet-contrib | affected |
|
No data.
No data.
No data.
Project Subscriptions
No data.
| Source | ID | Title |
|---|---|---|
 Github GHSA |
GHSA-55m9-299j-53c7 | OneCollector exporter reads unbounded HTTP response bodies |
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
Wed, 06 May 2026 21:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | OpenTelemetry.Exporter.OneCollector is a .NET exporter that sends telemetry to a OneCollector back-end over HTTP. In versions 1.15.0 and earlier, when a request to the configured back-end or collector results in an unsuccessful HTTP 4xx or 5xx response, the HttpJsonPostTransport class reads the entire response body into memory with no upper bound on the number of bytes consumed in order to include the error response in operator logs. An attacker who controls the configured endpoint, or who can intercept traffic to it via a man-in-the-middle attack, can return an arbitrarily large response body. This causes unbounded heap allocation in the consuming process, leading to high transient memory pressure, garbage-collection stalls, or an OutOfMemoryException that terminates the process. As a workaround, use network-level controls such as firewall rules, mTLS, or a service mesh to prevent man-in-the-middle attacks on the configured back-end or collector endpoint. This issue is fixed in version 1.15.1, which limits the number of bytes read from the response body in an error condition to 4 MiB. | |
| Title | OpenTelemetry.Exporter.OneCollector vulnerable to denial of service via unbounded HTTP error response body | |
| Weaknesses | CWE-770 | |
| References |
| |
| Metrics |
cvssV3_1
|
Projects
Sign in to view the affected projects.
MITRE
Status: PUBLISHED
Assigner: GitHub_M
Published:
Updated: 2026-05-06T21:00:07.430Z
Reserved: 2026-04-20T16:14:19.006Z
Link: CVE-2026-41484
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-05-06T22:16:26.050
Modified: 2026-05-06T22:16:26.050
Link: CVE-2026-41484
Redhat
No data.
OpenCVE Enrichment
No data.