Description
OpenTelemetry-Go Contrib is a collection of third-party packages for OpenTelemetry-Go. Starting in version 0.37.0 and prior to version 0.46.0, the grpc Unary Server Interceptor out of the box adds labels `net.peer.sock.addr` and `net.peer.sock.port` that have unbound cardinality. It leads to the server's potential memory exhaustion when many malicious requests are sent. An attacker can easily flood the peer address and port for requests. Version 0.46.0 contains a fix for this issue. As a workaround to stop being affected, a view removing the attributes can be used. The other possibility is to disable grpc metrics instrumentation by passing `otelgrpc.WithMeterProvider` option with `noop.NewMeterProvider`.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| open-telemetry | opentelemetry-go-contrib | >= 0.37.0, < 0.46.0 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | golang-opentelemetry-contrib | No fix yet | — |
| Ubuntu 26.04 LTS | golang-opentelemetry-contrib | No fix yet | — |
| Ubuntu 25.10 | golang-opentelemetry-contrib | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat OpenShift 4 | cri-o | 1.25.5-6.rhaos4.12.gitfcf6ef3.el8 | RHSA-2024:0489, RHSA-2024:0288, RHSA-2024:0207 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP6 | containerd | 1.7.21-150000.117.1 | SUSE-SU-2024:3221-1 |
| SLES 15 SP6 | docker | 26.1.5_ce-150000.212.1 | SUSE-SU-2024:4360-1 |
| SLES 15 SP5 | containerd | 1.7.21-150000.117.1 | SUSE-SU-2024:3221-1 |
| SLES 15 SP5 | docker | 26.1.5_ce-150000.212.1 | SUSE-SU-2024:4360-1 |
| SLES 15 SP4 | containerd | 1.7.21-150000.117.1 | SUSE-SU-2024:3221-1 |
| SLES 15 SP4 | docker | 26.1.5_ce-150000.212.1 | SUSE-SU-2024:4360-1 |
| SLES 15 SP3 | containerd | 1.7.21-150000.117.1 | SUSE-SU-2024:3221-1 |
| SLES 15 SP3 | docker | 26.1.5_ce-150000.212.1 | SUSE-SU-2024:4360-1 |
| SLES 15 SP2 | containerd | 1.7.21-150000.117.1 | SUSE-SU-2024:3221-1 |
| SLES 15 SP2 | docker | 26.1.5_ce-150000.212.1 | SUSE-SU-2024:4360-1 |
Show 17 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 12 SP5 | docker | 26.1.5_ce-98.120.1 | SUSE-SU-2024:4319-1 |
| SLES 12 | containerd | 1.7.21-16.94.1 | SUSE-SU-2024:3188-1 |
| SLES for SAP 15 SP4 | containerd | 1.7.21-150000.117.1 | SUSE-SU-2024:3221-1 |
| SLES for SAP 15 SP4 | docker | 26.1.5_ce-150000.212.1 | SUSE-SU-2024:4360-1 |
| SLES for SAP 15 SP3 | containerd | 1.7.21-150000.117.1 | SUSE-SU-2024:3221-1 |
| SLES for SAP 15 SP3 | docker | 26.1.5_ce-150000.212.1 | SUSE-SU-2024:4360-1 |
| SLES for SAP 15 SP2 | containerd | 1.7.21-150000.117.1 | SUSE-SU-2024:3221-1 |
| SLES for SAP 15 SP2 | docker | 26.1.5_ce-150000.212.1 | SUSE-SU-2024:4360-1 |
| SLE Micro 6.1 | docker | 27.5.1_ce-slfo.1.1_1.1 | SUSE-SU-2025:20259-1 |
| SLE Micro 6.0 | containerd | 1.7.21-1.1 | SUSE-SU-2025:20091-1 |
| SLE Micro 6.0 | docker | 26.1.5_ce-1.1 | SUSE-SU-2025:20110-1 |
| SLE Micro 6.0 | docker-compose | 2.33.1-1.1 | SUSE-SU-2025:20385-1 |
| SLE Micro 5.5 | containerd | 1.7.21-150000.117.1 | SUSE-SU-2024:3221-1 |
| SLE Micro 5.5 | docker | 26.1.5_ce-150000.212.1 | SUSE-SU-2024:4360-1 |
| SLE Micro 5.4 | containerd | 1.7.21-150000.117.1 | SUSE-SU-2024:3221-1 |
| SLE Micro 5.4 | docker | 26.1.5_ce-150000.212.1 | SUSE-SU-2024:4360-1 |
| SLE Micro 5.3 | containerd | 1.7.21-150000.117.1 | SUSE-SU-2024:3221-1 |
| SLE Micro 5.3 | docker | 26.1.5_ce-150000.212.1 | SUSE-SU-2024:4360-1 |
| SLE Micro 5.2 | containerd | 1.7.21-150000.117.1 | SUSE-SU-2024:3221-1 |
| SLE Micro 5.2 | docker | 26.1.5_ce-150000.212.1 | SUSE-SU-2024:4360-1 |
| SLE Micro 5.1 | containerd | 1.7.21-150000.117.1 | SUSE-SU-2024:3221-1 |
| SLE Micro 5.1 | docker | 26.1.5_ce-150000.212.1 | SUSE-SU-2024:4360-1 |
| SLE HPC 15 SP4 | containerd | 1.7.21-150000.117.1 | SUSE-SU-2024:3221-1 |
| SLE HPC 15 SP4 | docker | 26.1.5_ce-150000.212.1 | SUSE-SU-2024:4360-1 |
| SLE HPC 15 SP3 | containerd | 1.7.21-150000.117.1 | SUSE-SU-2024:3221-1 |
| SLE HPC 15 SP3 | docker | 26.1.5_ce-150000.212.1 | SUSE-SU-2024:4360-1 |
| SLE HPC 15 SP2 | containerd | 1.7.21-150000.117.1 | SUSE-SU-2024:3221-1 |
| SLE HPC 15 SP2 | docker | 26.1.5_ce-150000.212.1 | SUSE-SU-2024:4360-1 |
| SUSE Package Hub 15 SP6 | etcd | 3.5.12-bp156.4.3.1 | openSUSE-SU-2025:0003-1 |
| SUSE Enterprise Storage 7.1 | containerd | 1.7.21-150000.117.1 | SUSE-SU-2024:3221-1 |
| SUSE Enterprise Storage 7.1 | docker | 26.1.5_ce-150000.212.1 | SUSE-SU-2024:4360-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | containerd | 1.7.21-1.1 | openSUSE-SU-2024:14320-1 |
| openSUSE Tumbleweed | docker | 26.1.5_ce-2.1 | openSUSE-SU-2024:14321-1 |
| openSUSE Tumbleweed | etcd | 3.5.11-1.1 | openSUSE-SU-2024:13615-1 |
| openSUSE Tumbleweed | etcd-for-k8s1.27 +2 | 3.5.12-1.1 | openSUSE-SU-2024:13836-1, openSUSE-SU-2024:13835-1, openSUSE-SU-2024:13834-1 |
| openSUSE Tumbleweed | okteto | 2.28.0-1.1 | openSUSE-SU-2024:14032-1 |
| openSUSE Leap 16.0 | govulncheck-vulndb | 0.0.20260723T184607-160000.1.1 | openSUSE-SU-2026:21483-1 |
| openSUSE Leap 15.6 | containerd | 1.7.21-150000.117.1 | SUSE-SU-2024:3221-1 |
| openSUSE Leap 15.6 | docker | 26.1.5_ce-150000.212.1 | SUSE-SU-2024:4360-1 |
| openSUSE Leap 15.6 | etcd | 3.5.12-bp156.4.3.1 | openSUSE-SU-2025:0003-1, SUSE-SU-2024:3656-1 |
| openSUSE Leap 15.5 | containerd | 1.7.21-150000.117.1 | SUSE-SU-2024:3221-1 |
| openSUSE Leap 15.5 | docker | 26.1.5_ce-150000.212.1 | SUSE-SU-2024:4360-1 |
| openSUSE Leap 15.5 | etcd | 3.5.12-150000.7.6.1 | SUSE-SU-2024:3656-1 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Leap Micro 5.5 | containerd | 1.7.21-150000.117.1 | SUSE-SU-2024:3221-1 |
| openSUSE Leap Micro 5.5 | docker | 26.1.5_ce-150000.212.1 | SUSE-SU-2024:4360-1 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | amazon-cloudwatch-agent | 1.300032.3-1.amzn2023 | ALAS2023-2024-498 |
| Amazon Linux 2 | amazon-cloudwatch-agent | 1.300032.3-1.amzn2 | ALAS2-2024-2424 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | containerd | 1.7.13-3 | — |
| Azure Linux 3 | docker-buildx | 0.14.0-1 | — |
| Azure Linux 3 | docker-compose | 2.27.0-1 | — |
| Azure Linux 3 | ig | 0.30.0-1 | — |
| Azure Linux 3 | kube-vip-cloud-provider | 0.0.10-1 | — |
| Azure Linux 3 | moby-containerd-cc | 1.7.7-3 | — |
| Azure Linux 2 (CBL-Mariner) | moby-containerd-cc | 1.7.2-3 | — |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | buildkitd | 0.25.2-r1 | — |
| Wolfi rolling | crictl +2 | 1.29.0-r2 | — |
| Wolfi rolling | docker-compose | 2.24.6-r0 | — |
| Wolfi rolling | envoy-ratelimit | 0.0_git20231110-r0 | — |
| Wolfi rolling | k3s | 1.28.3-r2 | — |
| Wolfi rolling | kine | 0.11.3-r1 | — |
| Wolfi rolling | kubectl-1.25 +8 | No fix yet | — |
| Wolfi rolling | kubectl-1.28 +2 | 1.28.9-r0 | — |
| Wolfi rolling | kubectl-1.29 +2 | 1.29.3-r1 | — |
| Wolfi rolling | kubernetes-csi-external-resizer | 1.10.0-r1 | — |
| Wolfi rolling | kubescape | 3.0.3-r1 | — |
| Wolfi rolling | kubevela | 1.9.7-r3 | — |
| Wolfi rolling | metrics-server | 0.8.0-r4 | — |
| Wolfi rolling | temporal | 0.11.0-r4 | — |
| Wolfi rolling | temporal-server | 1.23.0-r0 | — |
| Wolfi rolling | volume-modifier-for-k8s | 0.5.1-r4 | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
GitHub 1 repository
-
bahe-msft/govuln-CVE-2023-47108 ★ 0 · Jun 25, 2024
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc | >= 0.37.0, < 0.46.0 | 0.46.0 | GHSA-8pgv-569h-w5rw |
Advisories 27
- RHSA-2024:0489 Red Hat Security Advisory: OpenShift Container Platform 4.12.48 packages and security update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- RHSA-2024:0207 Red Hat Security Advisory: OpenShift Container Platform 4.14.9 packages and security update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- RHSA-2024:0288 Red Hat Security Advisory: OpenShift Container Platform 4.13.30 security update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- openSUSE-SU-2026:21483-1 Security update for govulncheck-vulndb SUSE / openSUSE Security Updates · Jul 31, 2026
- SUSE-SU-2025:20259-1 Security update for docker SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2025:20091-1 Security update for containerd SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2025:20110-1 Security update for docker SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2025:20385-1 Security update for docker-compose SUSE / openSUSE Security Updates · Mar 23, 2026
- WID-SEC-2024-1913 Red Hat OpenShift Container Platform: Mehrere Schwachstellen BSI CERT-Bund (WID) · Mar 3, 2026
- openSUSE-SU-2024:13615-1 etcd-3.5.11-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2025:0003-1 Security update for etcd SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2024:3221-1 Security update for containerd SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:14320-1 containerd-1.7.21-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:13836-1 etcd-for-k8s1.29-3.5.12-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2024:4360-1 Security update for docker SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:14321-1 docker-26.1.5_ce-2.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2024:4319-1 Security update for docker SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2024:3188-1 Security update for containerd SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:13834-1 etcd-for-k8s1.27-3.5.12-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2024:3656-1 Security update for etcd SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:13835-1 etcd-for-k8s1.28-3.5.12-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:14032-1 okteto-2.28.0-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- WID-SEC-2024-1474 Red Hat OpenShift Container Platform: Mehrere Schwachstellen BSI CERT-Bund (WID) · Aug 26, 2025
- WID-SEC-2024-0137 Red Hat OpenShift Container Platform: Mehrere Schwachstellen ermöglichen Denial of Service BSI CERT-Bund (WID) · Jun 4, 2025
- WID-SEC-2024-0641 Red Hat Enterprise Linux (Advanced Cluster Management): Mehrere Schwachstellen BSI CERT-Bund (WID) · Jun 3, 2025
- ALAS2023-2024-498 Important: amazon-cloudwatch-agent security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Feb 29, 2024
- ALAS2-2024-2424 Important: amazon-cloudwatch-agent security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Feb 29, 2024
References
- https://github.com/open-telemetry/opentelemetry-go-contrib/security/advisories/GHSA-8pgv-569h-w5rw
- https://github.com/open-telemetry/opentelemetry-go-contrib/pull/4322
- https://github.com/open-telemetry/opentelemetry-go-contrib/commit/04c5dcbb5b35f14b4e6793b245919c72addbc7d0
- https://github.com/open-telemetry/opentelemetry-go-contrib/commit/b44dfc9092b157625a5815cb437583cee663333b
- https://github.com/open-telemetry/opentelemetry-go-contrib/blob/9d4eb7e7706038b07d33f83f76afbe13f53d171d/instrumentation/google.golang.org/grpc/otelgrpc/interceptor.go#L327
- https://github.com/open-telemetry/opentelemetry-go-contrib/blob/instrumentation/google.golang.org/grpc/otelgrpc/v0.45.0/instrumentation/google.golang.org/grpc/otelgrpc/config.go#L138
- https://pkg.go.dev/go.opentelemetry.io/otel/metric/noop#NewMeterProvider