CVE-2026-44967

A flaw was found in opentelemetry-cpp. The OTLP HTTP exporters (traces/metrics/logs) read the full HTTP response into an in-memory vector of bytes without a size cap. This can be exploited by an attacker-controlled collector endpoint or a network attacker performing a Man-in-the-Middle (MITM) attack. Successful exploitation leads to memory exhaustion, resulting in a Denial of Service (DoS).

A memory exhaustion vulnerability was found in OpenTelemetry C++, a C++ implementation of the OpenTelemetry observability framework. In versions prior to 1.27.0, the OTLP HTTP exporters for traces, metrics, and logs read the full HTTP response into an in-memory vector of bytes without a size cap. An attacker who controls the configured collector endpoint, or who can perform a man-in-the-middle attack on the exporter connection, can return an arbitrarily large or infinite HTTP response, causing the exporter to allocate unbounded memory. This can lead to memory exhaustion and denial of service through process crashes or system resource exhaustion. This issue affects Red Hat AMQ Clients versions 2026.Q1 and 2026.Q3, which bundle OpenTelemetry C++ version 1.19.0.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

This issue is fixed in OpenTelemetry C++ version 1.27.0. Red Hat will provide updated versions of AMQ Clients that include the fixed library version.

Until updates are available, administrators can reduce the risk of memory exhaustion attacks by implementing the following mitigations:

1. Configure OTLP HTTP exporters to use only trusted, validated collector endpoints. Ensure collector endpoints are under organizational control and cannot be modified by untrusted parties.

2. Use TLS/HTTPS for telemetry export connections and implement certificate pinning or strict certificate validation to prevent man-in-the-middle attacks.

3. Deploy telemetry collectors on isolated, trusted networks that are not accessible to potential attackers.

4. Implement system-level memory limits (cgroups, ulimits) for processes using OpenTelemetry exporters to contain the impact of memory exhaustion attacks.

5. Monitor memory usage of applications using OpenTelemetry exporters and configure alerts for unusual memory consumption patterns.

6. Consider using alternative export protocols (such as OTLP gRPC instead of OTLP HTTP) if they are supported by your collector infrastructure, as this vulnerability is specific to the HTTP implementation.

7. Upgrade to OpenTelemetry C++ 1.27.0 or later as soon as updated AMQ Clients packages are available from Red Hat.