The vulnerability in open-telemetry's opentelemetry-dotnet-contrib (<= 1.15.0-beta.1) involves the AzureVmMetaDataRequestor class making HTTP requests to the Azure VM instance metadata service and reading the entire response body into memory without any size limit. An attacker who can control or intercept the metadata endpoint can supply an arbitrarily large response, causing unbounded heap allocation. This results in high transient memory usage, potential garbage collection stalls, or an OutOfMemoryException that terminates the process. The issue is addressed in version 1.15.1-beta.1 by streaming responses instead of buffering them fully and ignoring responses larger than 4 MiB. Mitigations include disabling the Azure VM resource detector or applying network-level controls such as firewall rules, mTLS, or service mesh to prevent interception.

The vulnerability can cause denial of service by exhausting memory resources in the affected process, leading to garbage collection delays or process termination. There is no impact on confidentiality or integrity reported. The CVSS score is 5.9 (medium severity) with the main impact being availability disruption. No known exploits in the wild have been reported.

A fix is available in open-telemetry opentelemetry-dotnet-contrib version 1.15.1-beta.1, which streams responses and limits response size to 4 MiB. Users should upgrade to this version to remediate the vulnerability. As a workaround, disabling the Azure VM resource detector or implementing network-level protections such as firewall rules, mutual TLS, or service mesh to prevent man-in-the-middle attacks on the Azure VM instance metadata endpoint can mitigate the risk.