CVE-2026-44967

[CVE catalog]

Severity

Medium · CVSS 5.3CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Published

Jun 12, 2026, 2:52:00 PM UTC

Source

[NVD] · [CVE record]

EPSS

0.21% · Oct 25, 2026

A flaw was found in opentelemetry-cpp. The OTLP HTTP exporters (traces/metrics/logs) read the full HTTP response into an in-memory vector of bytes without a size cap. This can be exploited by an attacker-controlled collector endpoint or a network attacker performing a Man-in-the-Middle (MITM) attack. Successful exploitation leads to memory exhaustion, resulting in a Denial of Service (DoS). opentelemetry-: opentelemetry-cpp: Denial of Service via unbounded HTTP response read A memory exhaustion vulnerability was found in OpenTelemetry C++, a C++ implementation of the OpenTelemetry observability framework. In versions prior to 1.27.0, the OTLP HTTP exporters for traces, metrics, and logs read the full HTTP response into an in-memory vector of bytes without a size cap. An attacker who controls the configured collector endpoint, or who can perform a man-in-the-middle attack on the exporter connection, can return an arbitrarily large or infinite HTTP response, causing the exporter to allocate unbounded memory. This can lead to memory exhaustion and denial of service through process crashes or system resource exhaustion. This issue affects Red Hat AMQ Clients versions 2026.Q1 and 2026.Q3, which bundle OpenTelemetry C++ version 1.19.0. The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.