OpenTelemetry.Exporter.OneCollector in opentelemetry-dotnet-contrib versions up to 1.15.0 has a resource allocation vulnerability (CWE-770) where the HttpJsonPostTransport class reads an entire HTTP error response body into memory without limits. An attacker who controls or intercepts the configured backend endpoint can supply an arbitrarily large response body, causing unbounded heap allocation in the process. This results in high transient memory usage, garbage collection stalls, or OutOfMemoryException crashes. The vulnerability is fixed in version 1.15.1 by capping the read size to 4 MiB. Mitigations include network controls to prevent man-in-the-middle attacks.

Successful exploitation allows an attacker controlling or intercepting the configured backend endpoint to cause unbounded memory consumption in the affected process. This can lead to degraded performance due to garbage collection stalls or process termination via OutOfMemoryException. The vulnerability does not impact confidentiality or integrity but affects availability of the telemetry exporter process.

Upgrade to opentelemetry-dotnet-contrib version 1.15.1 or later, which limits the size of error response bodies read to 4 MiB, effectively mitigating the issue. If upgrading is not immediately possible, implement network-level controls such as firewall rules, mutual TLS (mTLS), or a service mesh to prevent man-in-the-middle attacks on the configured backend or collector endpoint. Patch status is not explicitly stated in the vendor advisory, but the fix is available in version 1.15.1.