OpenTelemetry.Exporter.OneCollector in opentelemetry-dotnet-contrib (<= 1.15.0) has a resource allocation vulnerability (CWE-770) where the HttpJsonPostTransport class reads the entire HTTP error response body into memory without an upper bound. This allows an attacker controlling or intercepting the backend endpoint to cause unbounded heap allocation, resulting in high memory usage, garbage collection stalls, or process termination due to OutOfMemoryException. The vulnerability is fixed in version 1.15.1 by capping the response body read size to 4 MiB. No official patch advisory is provided in the input, but upgrading to 1.15.1 is the recommended fix. Network-level controls can mitigate exploitation risk.

The vulnerability can cause denial of service by exhausting memory resources of the process using the vulnerable OpenTelemetry exporter. This leads to transient high memory pressure, garbage collection delays, or process crashes (OutOfMemoryException). There is no impact on confidentiality or integrity reported. Exploitation requires control or interception of the configured backend endpoint to supply a large HTTP error response body.

Upgrade to opentelemetry-dotnet-contrib version 1.15.1 or later, which limits the size of the HTTP error response body read to 4 MiB, effectively mitigating the vulnerability. In the absence of immediate upgrade, implement network-level controls such as firewall rules, mutual TLS (mTLS), or service mesh configurations to prevent man-in-the-middle attacks on the configured backend or collector endpoint. Patch status is not explicitly confirmed in the vendor advisory data, but the fix is included in version 1.15.1.