The vulnerability arises because the AWSXRaySamplerClient.DoRequestAsync method uses HttpClient.SendAsync followed by ReadAsStringAsync to read the entire HTTP response body into memory without size limits. If an attacker controls or can intercept the configured sampling endpoint (default http://localhost:2000), they can supply an arbitrarily large response body. This causes unbounded heap allocation in the consuming process, leading to performance degradation or process crashes. The issue affects versions of opentelemetry-dotnet-contrib prior to 0.1.0-alpha.8 and is fixed in that version.

Exploitation can cause the affected application to consume excessive memory, resulting in high transient memory pressure, garbage collection stalls, or an OutOfMemoryException that terminates the process. There is no direct impact on confidentiality or integrity, but availability is affected due to potential process crashes or degraded performance.

A fix is available in version 0.1.0-alpha.8 of opentelemetry-dotnet-contrib. Users should upgrade to this version or later to remediate the vulnerability. Since this is a cloud service component, the vendor manages remediation for the cloud-hosted service; users should verify with the vendor advisory for the latest status. Until patched, ensure that the configured AWS X-Ray remote sampling endpoint is trusted and protected from interception or manipulation.