High severity · published May 12, 2026
CVE-2026-42348
OpAMP client reads unbounded HTTP response bodies
7.5
CVSS
0.3%
EPSS
No
On KEV
Description
OpenTelemetry.OpAmp.Client is the OpAMP client for OpenTelemetry .NET. Prior to 0.2.0-alpha.1, when receiving responses from the OpAMP server over HTTP, the OpAMP client allocates an unbounded buffer to read all bytes from the server, with no upper-bound on the number of bytes consumed. This could cause memory exhaustion in the consuming application if the configured OpAMP server is attacker-controlled (or a network attacker can MitM the connection) and an extremely large body is returned in the response. This vulnerability is fixed in 0.2.0-alpha.1.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 24% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OP
opentelemetry-dotnet-contrib · open-telemetry
< 0.2.0-alpha.1 · source: vendor
OP
Affected product
OP
opentelemetry-dotnet-contrib
open-telemetry
More from opentelemetry-dotnet-contrib
7.0
CVE-2026-81192
OpenTelemetry.Resources.Host vulnerable to arbitrary code execution via local PATH hijacking on macOS
6.5
CVE-2026-44213
OpenTelemetry.Exporter.Instana bypasses TLS certificate validation when a proxy is configured
5.9
CVE-2026-41484
OpenTelemetry.Exporter.OneCollector vulnerable to denial of service via unbounded HTTP error response body
5.9
CVE-2026-41483
Unbounded HTTP response body read in OpenTelemetry.Resources.Azure
5.9
CVE-2026-41173
Unbounded HTTP response body read in OpenTelemetry.Sampler.AWS