CVE-2026-44967 describes a memory allocation with excessive size value vulnerability (CWE-789) in the open-telemetry opentelemetry-cpp library. Specifically, versions before 1.27.0 of the OTLP HTTP exporters (for traces, metrics, and logs) read the entire HTTP response into an in-memory byte vector without imposing a size limit. This behavior can be exploited to cause memory exhaustion when the configured collector endpoint is malicious or when a man-in-the-middle attacker can manipulate the exporter’s HTTP response. The vulnerability is addressed by limiting or properly handling the response size in release 1.27.0.

The vulnerability can cause memory exhaustion on systems running vulnerable versions of opentelemetry-cpp when communicating with a malicious or compromised collector endpoint or under a man-in-the-middle attack. This results in denial of service due to resource exhaustion. There is no impact on confidentiality or integrity reported.

This vulnerability is fixed in opentelemetry-cpp version 1.27.0. Users should upgrade to version 1.27.0 or later to remediate this issue. No official patch or temporary fix is indicated beyond upgrading. Until upgraded, avoid using untrusted or attacker-controlled collector endpoints and protect exporter connections from interception.