The open-telemetry opentelemetry-go library versions before 1.43.0 contain a memory allocation vulnerability (CWE-789) in the otlp HTTP exporters for traces, metrics, and logs. These exporters read the entire HTTP response body into an unbounded bytes.Buffer, which can be exploited to cause memory exhaustion when communicating with a malicious or compromised collector endpoint or via a man-in-the-middle attack. This vulnerability has a CVSS 3.1 base score of 5.3, reflecting a medium severity impact primarily on availability. The issue is resolved in version 1.43.0 of the library.

Successful exploitation can cause memory exhaustion on systems using vulnerable versions of opentelemetry-go, potentially leading to denial of service due to resource depletion. There is no impact on confidentiality or integrity according to the CVSS vector. The attack requires network access to the configured collector endpoint or the ability to intercept and modify exporter communications.

Upgrade to opentelemetry-go version 1.43.0 or later, where this vulnerability is fixed. Since no official patch link or advisory is provided, users should verify the version upgrade as the remediation. Patch status is confirmed by the vendor stating the fix is included in version 1.43.0. Until upgraded, avoid using untrusted or attacker-controlled collector endpoints and secure network communications to prevent man-in-the-middle attacks.