Description
The OpenTelemetry Collector offers a vendor-agnostic implementation on how to receive, process and export telemetry data. An unsafe decompression vulnerability allows unauthenticated attackers to crash the collector via excessive memory consumption. OTel Collector version 0.102.1 fixes this issue. It is also fixed in the confighttp module version 0.102.0 and configgrpc module version 0.102.1.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| open-telemetry | opentelemetry-collector | < 0.102.1 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | alloy | 1.4.3-1.1 | openSUSE-SU-2024:14439-1 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | amazon-cloudwatch-agent | 1.300044.0-1.amzn2023 | ALAS2023-2024-708 |
| Amazon Linux 2 | amazon-cloudwatch-agent | 1.300044.0-1.amzn2 | ALAS2-2024-2630 |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | opentelemetry-collector | 0.102.1-r0 | — |
| Wolfi rolling | opentelemetry-collector-contrib +1 | 0.102.0-r2 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | go.opentelemetry.io/collector/config/configgrpc | < 0.102.1 | 0.102.1 | GHSA-c74f-6mfw-mm4v |
| Go | go.opentelemetry.io/collector/config/confighttp | < 0.102.0 | 0.102.0 | GHSA-c74f-6mfw-mm4v |
Advisories 6
- openSUSE-SU-2024:14439-1 alloy-1.4.3-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- WID-SEC-2024-3674 Splunk Splunk Enterprise: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jan 25, 2026
- WID-SEC-2024-1392 Red Hat OpenShift: Schwachstelle ermöglicht Denial of Service BSI CERT-Bund (WID) · Sep 5, 2024
- ALAS2-2024-2630 Important: amazon-cloudwatch-agent security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Sep 5, 2024
- ALAS2023-2024-708 Important: amazon-cloudwatch-agent security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Sep 4, 2024
- WID-SEC-2024-1680 IBM App Connect Enterprise: Schwachstelle ermöglicht Denial of Service BSI CERT-Bund (WID) · Jul 18, 2024