The open-telemetry opentelemetry-go library versions before 1.43.0 contain a memory allocation vulnerability (CWE-789) in the otlp HTTP exporters for traces, metrics, and logs. These exporters read the entire HTTP response body into an in-memory bytes.Buffer without imposing a maximum size cap. An attacker controlling the collector endpoint or able to perform a man-in-the-middle attack on the exporter connection can exploit this behavior to cause memory exhaustion on the client system. The vulnerability is addressed by limiting or properly handling the size of the response body in version 1.43.0.

Successful exploitation can cause memory exhaustion on systems running vulnerable versions of opentelemetry-go, potentially leading to denial of service due to resource depletion. There is no impact on confidentiality or integrity reported. The attack requires either control over the collector endpoint or the ability to intercept and modify network traffic.

Upgrade opentelemetry-go to version 1.43.0 or later, where this vulnerability is fixed. No other official remediation or temporary fixes are documented. Until upgrading, avoid using untrusted or attacker-controlled collector endpoints and secure network communications to prevent man-in-the-middle attacks.