CVE-2024-36129: opentelemetry configgrpc +2 lainnya

csirt@kutim:~/threat-intel/cve/CVE-2024-36129

CVSS 7.5 · High EPSS 1,2%

Kerentanan Improper Restriction of Operations within the Bounds of a Memory Buffer pada opentelemetry configgrpc, opentelemetry confighttp +1 lainnya. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

The OpenTelemetry Collector offers a vendor-agnostic implementation on how to receive, process and export telemetry data. An unsafe decompression vulnerability allows unauthenticated attackers to crash the collector via excessive memory consumption. OTel Collector version 0.102.1 fixes this issue. It is also fixed in the confighttp module version 0.102.0 and configgrpc module version 0.102.1.

Rincian

Terbit di NVD: 5 Juni 2024
Terakhir diubah: 17 Juni 2026
Status NVD: Modified
CVSS 3.1: 7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer
EPSS (30 hari): 1,2% peluang dieksploitasi; lebih tinggi dari 68,4% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
opentelemetry	configgrpc	Semua versi sebelum 0.102.1
opentelemetry	confighttp	Semua versi sebelum 0.102.0
opentelemetry	opentelemetry collector	Semua versi sebelum 0.102.1

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://opentelemetry.io/blog/2024/cve-2024-36129 advisory vendor
https://github.com/open-telemetry/opentelemetry-collector/pull/10289 patch
https://github.com/open-telemetry/opentelemetry-collector/pull/10323 patch
https://github.com/open-telemetry/opentelemetry-collector/security/advisories/GHSA-c74f-6mfw-mm4v exploit · advisory pihak ketiga

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:11 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.