The OpenTelemetry.OpAmp.Client prior to version 0.2.0-alpha.1 does not impose an upper bound on the size of the buffer allocated to read HTTP responses from the OpAMP server. This lack of size limitation allows an attacker controlling the OpAMP server or performing a man-in-the-middle attack to cause the client to allocate excessive memory, potentially exhausting system resources. This vulnerability is classified under CWE-789 (Memory Allocation with Excessive Size Value). The issue has a CVSS v3.1 base score of 5.9, reflecting a network attack vector with high complexity and no privileges required, resulting in availability impact only. The vulnerability is resolved in version 0.2.0-alpha.1 of the opentelemetry-dotnet-contrib package.

An attacker capable of controlling the OpAMP server or intercepting the network traffic can cause the vulnerable client to allocate an unbounded amount of memory by sending an extremely large HTTP response body. This can lead to memory exhaustion and potentially cause the consuming application to crash or become unresponsive, impacting availability. There is no impact on confidentiality or integrity according to the CVSS vector.

This vulnerability is fixed in opentelemetry-dotnet-contrib version 0.2.0-alpha.1. Users should upgrade to this version or later to remediate the issue. Since no official patch or temporary fix is indicated beyond upgrading, applying this update is the recommended action. There is no indication that the vulnerability is mitigated by configuration or network controls alone.