go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Feed

High 7.5

CVE-2023-45142

OpenTelemetry-Go Contrib has DoS vulnerability in otelhttp due to unbound cardinality metrics

OpenTelemetry-Go Contrib is a collection of third-party packages for OpenTelemetry-Go. A handler wrapper out of the box adds labels `http.user_agent` and `http.method` that have unbound cardinality. It leads to the server's potential memory exhaustion when ma…

open-telemetry opentelemetry-go-contrib k3s buildkitd Ubuntu Azure Linux Alpine Wolfi Go

Oct 12, 2023
High 7.5

CVE-2023-25151

DoS vulnerability for high cardinality metrics in opentelemetry-go-contrib

opentelemetry-go-contrib is a collection of extensions for OpenTelemetry-Go. The v0.38.0 release of `go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp` uses the `httpconv.ServerRequest` function to annotate metric measurements for the `http.server…

open-telemetry opentelemetry-go-contrib golang-opentelemetry-contrib go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp Ubuntu Go

Feb 8, 2023