CVSS 5.9 · Medium EPSS 0,37%
Kerentanan Allocation of Resources Without Limits or Throttling pada opentelemetry. Skor CVSS 3.1 5.9 (Medium) menurut github.com.
OpenTelemetry dotnet is a dotnet telemetry framework. In 1.6.0-rc.1 and earlier, OpenTelemetry.Exporter.Jaeger may allow sustained memory pressure when the internal pooled-list sizing grows based on a large observed span/tag set and that enlarged size is reused for subsequent allocations. Under high-cardinality or attacker-influenced telemetry input, this can increase memory consumption and potentially cause denial of service. There is no plan to fix this issue as OpenTelemetry.Exporter.Jaeger was deprecated in 2023.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
· uraikan di kalkulator | Vendor | Produk | Versi terdampak |
|---|---|---|
| opentelemetry | opentelemetry | Semua versi sebelum 1.6.0 |
| opentelemetry | opentelemetry | Versi 1.6.0 alpha1 |
| opentelemetry | opentelemetry | Versi 1.6.0 beta1 |
| opentelemetry | opentelemetry | Versi 1.6.0 beta2 |
| opentelemetry | opentelemetry | Versi 1.6.0 beta3 |
| opentelemetry | opentelemetry | Versi 1.6.0 rc1 |