The open-telemetry opentelemetry-cpp library versions before 1.27.0 have a vulnerability (CWE-789) where the OTLP HTTP exporters for traces, metrics, and logs read the entire HTTP response into an in-memory byte vector without imposing a size limit. This behavior can be exploited to cause memory exhaustion if the configured collector endpoint is malicious or if a network attacker can perform a man-in-the-middle attack on the exporter connection. The vulnerability is addressed in version 1.27.0 of opentelemetry-cpp.

An attacker controlling the collector endpoint or able to intercept the network connection can cause the exporter to allocate excessive memory, potentially leading to denial of service due to memory exhaustion. There is no impact on confidentiality or integrity reported.

Upgrade to opentelemetry-cpp version 1.27.0 or later, where this vulnerability is fixed. No other official remediation or temporary fix is documented. Until upgrading, avoid using untrusted collector endpoints or ensure network protections to prevent man-in-the-middle attacks.