CVE-2026-42348
Description
OpenTelemetry.OpAmp.Client is the OpAMP client for OpenTelemetry .NET. Prior to 0.2.0-alpha.1, when receiving responses from the OpAMP server over HTTP, the OpAMP client allocates an unbounded buffer to read all bytes from the server, with no upper-bound on the number of bytes consumed. This could cause memory exhaustion in the consuming application if the configured OpAMP server is attacker-controlled (or a network attacker can MitM the connection) and an extremely large body is returned in the response. This vulnerability is fixed in 0.2.0-alpha.1.
How to fix
- opentelemetry opentelemetry.opamp.client0.2.0 or later
- OpenTelemetry.OpAmp.Client0.2.0-alpha.1 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| opentelemetry opentelemetry.opamp.client | v < 0.2.0 | 0.2.0 |
| OpenTelemetry.OpAmp.ClientNuGet | v < 0.2.0-alpha.1 | 0.2.0-alpha.1 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.