Vulnerabilidades em open-telemetry
62 resultadosAnálise Vexday
Open Telemetry apresenta volume moderado de vulnerabilidades (48 CVEs), com agravante de 28 lançadas nos últimos 90 dias, indicando ritmo acelerado de descobertas recentes. Nenhuma está sob exploração ativa (KEV zero) e apenas uma crítica foi registrada, reduzindo a urgência imediata. A fraqueza dominante é CWE-770 (alocação excessiva de recursos), padrão em componentes de processamento de dados que demanda atenção em ambientes de alta carga.
CVE-2026-40894MEDIUMOpenTelemetry dotnet: Excessive memory allocation when parsing OpenTelemetry propagation headersEPSS 0.5%CVE-2026-47256MEDIUMOpenTelemetry: Path traversal in Sentry exporter via attacker-controlled service.name reaches privileged Sentry API endpoints with operator bearer tokenEPSS 0.4%CVE-2026-48504MEDIUMOpenTelemetry Rust: Unbounded memory allocation in W3C Baggage propagationEPSS 0.4%CVE-2026-54285MEDIUMopentelemetry-js: Unbounded memory allocation in W3C Baggage propagationEPSS 0.4%CVE-2026-81872MEDIUMOpenTelemetry-Go: BatchProcessor can busy-spin when export buffer is fullEPSS 0.4%CVE-2026-54704MEDIUMOpenTelemetry Java Instrumentation: JDBC Auto-Instrumentation Logging Clear-Text PasswordsEPSS 0.4%CVE-2026-116694MEDIUMOpenTelemetry Python: Unbounded memory allocation in Jaeger baggage propagationEPSS 0.4%CVE-2026-45686HIGHOpenTelemetry eBPF Instrumentation: Memcached payload length overflow can crash OBIEPSS 0.4%CVE-2026-45678HIGHOpenTelemetry eBPF Instrumentation: Postgres BIND parsing can panic on malformed payloadsEPSS 0.3%CVE-2026-41484MEDIUMOpenTelemetry.Exporter.OneCollector vulnerable to denial of service via unbounded HTTP error response bodyEPSS 0.3%CVE-2026-41178MEDIUMOpenTelemetry-Go's baggage parsing no longer caps raw header lengthEPSS 0.3%CVE-2026-41483MEDIUMUnbounded HTTP response body read in OpenTelemetry.Resources.AzureEPSS 0.3%CVE-2026-45680MEDIUMOpenTelemetry eBPF Instrumentation: Unbounded BPF internal metrics replay can exhaust CPUEPSS 0.3%CVE-2026-41310MEDIUMOpenTelemetry .NET Zipkin exporter has unbounded remote endpoint cache leading to memory growthEPSS 0.3%CVE-2026-42348MEDIUMOpAMP client reads unbounded HTTP response bodiesEPSS 0.3%CVE-2026-40182MEDIUMOpenTelemetry dotnet: OTLP exporter reads unbounded HTTP response bodiesEPSS 0.3%CVE-2026-41173MEDIUMUnbounded HTTP response body read in OpenTelemetry.Sampler.AWSEPSS 0.3%CVE-2024-32028MEDIUMSensitive query parameters logged by default in OpenTelemetry.Instrumentation http and AspNetCoreEPSS 0.3%CVE-2026-45681MEDIUMOpenTelemetry eBPF Instrumentation: CPU-mismatch fallback uses 256-byte buffer with 8KB sizeEPSS 0.3%CVE-2026-81870LOWOpenTelemetry-Go: Exporter config logging may leak endpoint URLs in info logsEPSS 0.3%