Description
OpenTelemetry-Go Contrib is a collection of third-party packages for OpenTelemetry-Go. A handler wrapper out of the box adds labels `http.user_agent` and `http.method` that have unbound cardinality. It leads to the server's potential memory exhaustion when many malicious requests are sent to it. HTTP header User-Agent or HTTP method for requests can be easily set by an attacker to be random and long. The library internally uses `httpconv.ServerRequest` that records every value for HTTP `method` and `User-Agent`. In order to be affected, a program has to use the `otelhttp.NewHandler` wrapper and not filter any unknown HTTP methods or User agents on the level of CDN, LB, previous middleware, etc. Version 0.44.0 fixed this issue when the values collected for attribute `http.request.method` were changed to be restricted to a set of well-known values and other high cardinality attributes were removed. As a workaround to stop being affected, `otelhttp.WithFilter()` can be used, but it requires manual careful configuration to not log certain requests entirely. For convenience and safe usage of this library, it should by default mark with the label `unknown` non-standard HTTP methods and User agents to show that such requests were made but do not increase cardinality. In case someone wants to stay with the current behavior, library API should allow to enable it.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| open-telemetry | opentelemetry-go-contrib | < 0.44.0 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | golang-opentelemetry-contrib | No fix yet | — |
| Ubuntu 26.04 LTS | golang-opentelemetry-contrib | No fix yet | — |
| Ubuntu 25.10 | golang-opentelemetry-contrib | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Ceph Storage 5 | ceph +43 | 2:16.2.10-266.el8cp | RHSA-2024:4118 |
| Red Hat Ceph Storage 5 | ceph-ansible | 6.0.28.8-1.el8cp | RHSA-2024:4118 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP6 | containerd | 1.7.21-150000.117.1 | SUSE-SU-2024:3221-1 |
| SLES 15 SP6 | docker | 26.1.5_ce-150000.212.1 | SUSE-SU-2024:4360-1 |
| SLES 15 SP6 | golang-github-prometheus-prometheus | 2.45.6-150100.4.20.1 | SUSE-SU-2024:3288-1 |
| SLES 15 SP5 | containerd | 1.7.21-150000.117.1 | SUSE-SU-2024:3221-1 |
| SLES 15 SP5 | docker | 26.1.5_ce-150000.212.1 | SUSE-SU-2024:4360-1 |
| SLES 15 SP5 | golang-github-prometheus-prometheus | 2.45.6-150100.4.20.1 | SUSE-SU-2024:3288-1 |
| SLES 15 SP4 | containerd | 1.7.21-150000.117.1 | SUSE-SU-2024:3221-1 |
| SLES 15 SP4 | docker | 26.1.5_ce-150000.212.1 | SUSE-SU-2024:4360-1 |
| SLES 15 SP3 | containerd | 1.7.21-150000.117.1 | SUSE-SU-2024:3221-1 |
| SLES 15 SP3 | docker | 26.1.5_ce-150000.212.1 | SUSE-SU-2024:4360-1 |
| SLES 15 SP2 | containerd | 1.7.21-150000.117.1 | SUSE-SU-2024:3221-1 |
| SLES 15 SP2 | docker | 26.1.5_ce-150000.212.1 | SUSE-SU-2024:4360-1 |
Show 22 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 12 SP5 | docker | 26.1.5_ce-98.120.1 | SUSE-SU-2024:4319-1 |
| SLES 12 | containerd | 1.7.21-16.94.1 | SUSE-SU-2024:3188-1 |
| SLES for SAP 15 SP4 | containerd | 1.7.21-150000.117.1 | SUSE-SU-2024:3221-1 |
| SLES for SAP 15 SP4 | docker | 26.1.5_ce-150000.212.1 | SUSE-SU-2024:4360-1 |
| SLES for SAP 15 SP3 | containerd | 1.7.21-150000.117.1 | SUSE-SU-2024:3221-1 |
| SLES for SAP 15 SP3 | docker | 26.1.5_ce-150000.212.1 | SUSE-SU-2024:4360-1 |
| SLES for SAP 15 SP2 | containerd | 1.7.21-150000.117.1 | SUSE-SU-2024:3221-1 |
| SLES for SAP 15 SP2 | docker | 26.1.5_ce-150000.212.1 | SUSE-SU-2024:4360-1 |
| SLE Micro 6.1 | docker | 27.5.1_ce-slfo.1.1_1.1 | SUSE-SU-2025:20259-1 |
| SLE Micro 6.0 | containerd | 1.7.21-1.1 | SUSE-SU-2025:20091-1 |
| SLE Micro 6.0 | docker | 26.1.5_ce-1.1 | SUSE-SU-2025:20110-1 |
| SLE Micro 5.5 | containerd | 1.7.21-150000.117.1 | SUSE-SU-2024:3221-1 |
| SLE Micro 5.5 | docker | 26.1.5_ce-150000.212.1 | SUSE-SU-2024:4360-1 |
| SLE Micro 5.4 | containerd | 1.7.21-150000.117.1 | SUSE-SU-2024:3221-1 |
| SLE Micro 5.4 | docker | 26.1.5_ce-150000.212.1 | SUSE-SU-2024:4360-1 |
| SLE Micro 5.3 | containerd | 1.7.21-150000.117.1 | SUSE-SU-2024:3221-1 |
| SLE Micro 5.3 | docker | 26.1.5_ce-150000.212.1 | SUSE-SU-2024:4360-1 |
| SLE Micro 5.2 | containerd | 1.7.21-150000.117.1 | SUSE-SU-2024:3221-1 |
| SLE Micro 5.2 | docker | 26.1.5_ce-150000.212.1 | SUSE-SU-2024:4360-1 |
| SLE Micro 5.1 | containerd | 1.7.21-150000.117.1 | SUSE-SU-2024:3221-1 |
| SLE Micro 5.1 | docker | 26.1.5_ce-150000.212.1 | SUSE-SU-2024:4360-1 |
| SLE HPC 15 SP4 | containerd | 1.7.21-150000.117.1 | SUSE-SU-2024:3221-1 |
| SLE HPC 15 SP4 | docker | 26.1.5_ce-150000.212.1 | SUSE-SU-2024:4360-1 |
| SLE HPC 15 SP3 | containerd | 1.7.21-150000.117.1 | SUSE-SU-2024:3221-1 |
| SLE HPC 15 SP3 | docker | 26.1.5_ce-150000.212.1 | SUSE-SU-2024:4360-1 |
| SLE HPC 15 SP2 | containerd | 1.7.21-150000.117.1 | SUSE-SU-2024:3221-1 |
| SLE HPC 15 SP2 | docker | 26.1.5_ce-150000.212.1 | SUSE-SU-2024:4360-1 |
| SUSE Package Hub 15 SP6 | caddy | 2.8.4-bp156.3.3.1 | openSUSE-SU-2024:0220-1 |
| SUSE Package Hub 15 SP5 | caddy | 2.8.4-bp155.2.3.1 | openSUSE-SU-2024:0211-1 |
| SUSE Manager Proxy Module 4.3 | golang-github-prometheus-prometheus | 2.45.6-150100.4.20.1 | SUSE-SU-2024:3288-1 |
| SUSE Manager Client Tools for SLE Micro 5 | uyuni-tools | 0.1.21-150000.1.8.2 | SUSE-SU-2024:3267-1 |
| SUSE Manager Client Tools 15 | golang-github-prometheus-prometheus | 2.45.6-150000.3.56.1 | SUSE-SU-2024:3267-1 |
| SUSE Manager Client Tools 15 | rhnlib | 5.0.4-150000.3.46.1 | SUSE-SU-2024:3267-1 |
| SUSE Manager Client Tools 15 | spacecmd | 5.0.9-150000.3.124.1 | SUSE-SU-2024:3267-1 |
| SUSE Manager Client Tools 15 | uyuni-tools | 0.1.21-150000.1.8.2 | SUSE-SU-2024:3267-1 |
| SUSE Manager Client Tools 12 | golang-github-prometheus-prometheus | 2.45.6-1.53.1 | SUSE-SU-2024:3266-1 |
| SUSE Manager Client Tools 12 | rhnlib | 5.0.4-21.52.1 | SUSE-SU-2024:3266-1 |
| SUSE Manager Client Tools 12 | spacecmd | 5.0.9-38.147.1 | SUSE-SU-2024:3266-1 |
| SUSE Manager Client Tools 12 | uyuni-tools | 0.1.21-1.8.1 | SUSE-SU-2024:3266-1 |
| SUSE Enterprise Storage 7.1 | containerd | 1.7.21-150000.117.1 | SUSE-SU-2024:3221-1 |
| SUSE Enterprise Storage 7.1 | docker | 26.1.5_ce-150000.212.1 | SUSE-SU-2024:4360-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | caddy | 2.7.6-1.1 | openSUSE-SU-2024:13495-1 |
| openSUSE Tumbleweed | containerd | 1.7.21-1.1 | openSUSE-SU-2024:14320-1 |
| openSUSE Tumbleweed | docker | 26.1.5_ce-2.1 | openSUSE-SU-2024:14321-1 |
| openSUSE Tumbleweed | golang-github-prometheus-prometheus | 2.53.0-3.1 | openSUSE-SU-2024:14232-1 |
| openSUSE Tumbleweed | teleport | 14.1.1-1.1 | openSUSE-SU-2024:13360-1 |
| openSUSE Leap 15.6 | caddy | 2.8.4-bp156.3.3.1 | openSUSE-SU-2024:0220-1 |
| openSUSE Leap 15.6 | containerd | 1.7.21-150000.117.1 | SUSE-SU-2024:3221-1 |
| openSUSE Leap 15.6 | docker | 26.1.5_ce-150000.212.1 | SUSE-SU-2024:4360-1 |
| openSUSE Leap 15.6 | golang-github-prometheus-prometheus | 2.45.6-150100.4.20.1 | SUSE-SU-2024:3288-1 |
| openSUSE Leap 15.6 | spacecmd | 5.0.9-150000.3.124.1 | SUSE-SU-2024:3267-1 |
| openSUSE Leap 15.5 | caddy | 2.8.4-bp155.2.3.1 | openSUSE-SU-2024:0211-1 |
| openSUSE Leap 15.5 | containerd | 1.7.21-150000.117.1 | SUSE-SU-2024:3221-1 |
| openSUSE Leap 15.5 | docker | 26.1.5_ce-150000.212.1 | SUSE-SU-2024:4360-1 |
| openSUSE Leap 15.5 | golang-github-prometheus-prometheus | 2.45.6-150100.4.20.1 | SUSE-SU-2024:3288-1 |
| openSUSE Leap 15.5 | spacecmd | 5.0.9-150000.3.124.1 | SUSE-SU-2024:3267-1 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Leap Micro 5.5 | containerd | 1.7.21-150000.117.1 | SUSE-SU-2024:3221-1 |
| openSUSE Leap Micro 5.5 | docker | 26.1.5_ce-150000.212.1 | SUSE-SU-2024:4360-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | k3s | 1.29.3.1-r0 | — |
| Alpine v3.23 | k3s | 1.29.3.1-r0 | — |
| Alpine v3.22 | k3s | 1.29.3.1-r0 | — |
| Alpine v3.21 | k3s | 1.29.3.1-r0 | — |
| Alpine v3.20 | k3s | 1.29.3.1-r0 | — |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | amazon-cloudwatch-agent | 1.300032.3-1.amzn2023 | ALAS2023-2024-498 |
| Amazon Linux 2 | amazon-cloudwatch-agent | 1.300032.3-1.amzn2 | ALAS2-2024-2424 |
| Amazon Linux 2 | cri-tools | 1.29.0-1.amzn2.0.1 | ALAS2-2024-2446 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | cert-manager | 1.12.12-1 | — |
| Azure Linux 3 | docker-buildx | 0.14.0-1 | — |
| Azure Linux 3 | kube-vip-cloud-provider | 0.0.10-1 | — |
| Azure Linux 3 | kubernetes | 1.29.1-2 | — |
| Azure Linux 3 | opa | 0.63.0-1 | — |
| Azure Linux 3 | prometheus | 2.45.4-1 | — |
| Azure Linux 3 | prometheus-adapter | 0.12.0-1 | — |
| Azure Linux 2 (CBL-Mariner) | cri-tools | 1.29.0-2 | — |
| Azure Linux 2 (CBL-Mariner) | moby-compose | 2.17.3-7 | — |
| Azure Linux 2 (CBL-Mariner) | moby-engine | 24.0.9-10 | — |
| Azure Linux 2 (CBL-Mariner) | opa | 0.63.0-1 | — |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | buildkitd | 0.25.2-r1 | — |
| Wolfi rolling | caddy | 2.7.5-r1 | — |
| Wolfi rolling | k3s | 1.28.2-r2 | — |
| Wolfi rolling | kubectl-1.25 +8 | No fix yet | — |
| Wolfi rolling | kubectl-1.28 +2 | 1.28.9-r0 | — |
| Wolfi rolling | kubectl-1.29 +2 | 1.29.3-r1 | — |
| Wolfi rolling | kubectl-1.32 +1 | 1.32.0-r2 | — |
| Wolfi rolling | kubectl-1.33 +1 | 1.33.0-r1 | — |
| Wolfi rolling | kubevela | 1.9.7-r3 | — |
| Wolfi rolling | prometheus-adapter | 0.11.1-r4 | — |
| Wolfi rolling | up | 0.24.0-r1 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | go.opentelemetry.io/contrib/instrumentation/github.com/emicklei/go-restful/otelrestful | < 0.44.0 | 0.44.0 | GHSA-rcjv-mgp8-qvmr |
| Go | go.opentelemetry.io/contrib/instrumentation/github.com/gin-gonic/gin/otelgin | < 0.44.0 | 0.44.0 | GHSA-rcjv-mgp8-qvmr |
| Go | go.opentelemetry.io/contrib/instrumentation/github.com/gorilla/mux/otelmux | < 0.44.0 | 0.44.0 | GHSA-rcjv-mgp8-qvmr |
| Go | go.opentelemetry.io/contrib/instrumentation/github.com/labstack/echo/otelecho | < 0.44.0 | 0.44.0 | GHSA-rcjv-mgp8-qvmr |
| Go | go.opentelemetry.io/contrib/instrumentation/gopkg.in/macaron.v1/otelmacaron | < 0.44.0 | 0.44.0 | GHSA-rcjv-mgp8-qvmr |
| Go | go.opentelemetry.io/contrib/instrumentation/net/http/httptrace/otelhttptrace | < 0.44.0 | 0.44.0 | GHSA-rcjv-mgp8-qvmr |
| Go | go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp | < 0.44.0 | 0.44.0 | GHSA-rcjv-mgp8-qvmr |
Advisories 26
- RHSA-2024:4118 Red Hat Security Advisory: Red Hat Ceph Storage 5.3 security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- SUSE-SU-2025:20259-1 Security update for docker SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2025:20091-1 Security update for containerd SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2025:20110-1 Security update for docker SUSE / openSUSE Security Updates · Mar 23, 2026
- WID-SEC-2024-1913 Red Hat OpenShift Container Platform: Mehrere Schwachstellen BSI CERT-Bund (WID) · Mar 3, 2026
- SUSE-SU-2024:3221-1 Security update for containerd SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:0220-1 Security update for caddy SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:14232-1 golang-github-prometheus-prometheus-2.53.0-3.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:14320-1 containerd-1.7.21-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:13495-1 caddy-2.7.6-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2024:4360-1 Security update for docker SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:13360-1 teleport-14.1.1-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:14321-1 docker-26.1.5_ce-2.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2024:4319-1 Security update for docker SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2024:3288-1 Security update for golang-github-prometheus-prometheus SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2024:3188-1 Security update for containerd SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2024:3267-1 Security update for SUSE Manager Client Tools SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2024:3266-1 Security update for SUSE Manager Client Tools SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:0211-1 Security update for caddy SUSE / openSUSE Security Updates · Feb 4, 2026
- WID-SEC-2024-0869 Oracle Communications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Sep 10, 2025
- WID-SEC-2024-1474 Red Hat OpenShift Container Platform: Mehrere Schwachstellen BSI CERT-Bund (WID) · Aug 26, 2025
- WID-SEC-2024-0641 Red Hat Enterprise Linux (Advanced Cluster Management): Mehrere Schwachstellen BSI CERT-Bund (WID) · Jun 3, 2025
- WID-SEC-2023-3067 Red Hat OpenShift: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 13, 2024
- ALAS2023-2024-498 Important: amazon-cloudwatch-agent security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Feb 29, 2024
- ALAS2-2024-2424 Important: amazon-cloudwatch-agent security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Feb 29, 2024
- ALAS2-2024-2446 Important: cri-tools security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Feb 1, 2024
References
- https://github.com/open-telemetry/opentelemetry-go-contrib/security/advisories/GHSA-rcjv-mgp8-qvmr
- https://github.com/open-telemetry/opentelemetry-go-contrib/security/advisories/GHSA-5r5m-65gx-7vrh
- https://github.com/open-telemetry/opentelemetry-go-contrib/pull/4277
- https://github.com/advisories/GHSA-cg3q-j54f-5p7p
- https://github.com/open-telemetry/opentelemetry-go-contrib/blob/5f7e6ad5a49b45df45f61a1deb29d7f1158032df/instrumentation/net/http/otelhttp/handler.go#L63-L65
- https://github.com/open-telemetry/opentelemetry-go-contrib/releases/tag/v1.19.0
- https://github.com/open-telemetry/opentelemetry-go/blob/38e1b499c3da3107694ad2660b3888eee9c8b896/semconv/internal/v2/http.go#L223
- https://github.com/open-telemetry/opentelemetry-go/blob/v1.12.0/semconv/internal/v2/http.go#L159
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2UTRJ54INZG3OC2FTAN6AFB2RYNY2GAD/