Skip to content
OpenAdvisories
Medium · 5.9 CVE-2026-42348 EUVD-2026-29706GHSA-w2jh-77fq-7gp8

OpAMP client reads unbounded HTTP response bodies

Published May 12, 2026 · Updated May 13, 2026 · Assigned by GitHub_M

Description

OpenTelemetry.OpAmp.Client is the OpAMP client for OpenTelemetry .NET. Prior to 0.2.0-alpha.1, when receiving responses from the OpAMP server over HTTP, the OpAMP client allocates an unbounded buffer to read all bytes from the server, with no upper-bound on the number of bytes consumed. This could cause memory exhaustion in the consuming application if the configured OpAMP server is attacker-controlled (or a network attacker can MitM the connection) and an extremely large body is returned in the response. This vulnerability is fixed in 0.2.0-alpha.1.

Affected products

VendorProductAffectedFixed
open-telemetry opentelemetry-dotnet-contrib < 0.2.0-alpha.1 —

Affected packages

EcosystemPackageAffectedFixedRecord
NuGet OpenTelemetry.OpAmp.Client < 0.2.0-alpha.1 0.2.0-alpha.1 GHSA-w2jh-77fq-7gp8

References