opentelemetry-cpp: OTLP HTTP exporters read unbounded HTTP response

Description

OpenTelemetry-cpp is the C++ implementation of OpenTelemetry. Prior to release 1.27.0, the OTLP HTTP exporters (traces/metrics/logs) read the full HTTP response into an in-memory vector of bytes without a size cap. This is exploitable for memory exhaustion when the configured collector endpoint is attacker-controlled (or a network attacker can MITM the exporter connection). This vulnerability is fixed in opentelemetry-cpp release 1.27.0.

Scores

EPSS (exploitation in 30 days)

0.21% · top 89% of all CVEs (6 Nov 2026)

CISA SSVC

Exploitation: poc · Automatable: no · Technical impact: partial

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 5.3.

Weakness

• CWE-789: Memory Allocation with Excessive Size Value (opens in a new tab)All about CWE-789 and its CVEs

Affected products

• open-telemetry · opentelemetry-cpp

  • affected < 1.27.0

References (4)

• https://github.com/open-telemetry/opentelemetry-cpp/security/advisories/GHSA-5qhm-4rfp-qqvj (opens in a new tab)x_refsource_CONFIRM
• https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-w8rr-5gcm-pp58 (opens in a new tab)x_refsource_MISCexploit
• https://github.com/open-telemetry/opentelemetry-cpp/issues/3958 (opens in a new tab)x_refsource_MISC
• https://github.com/open-telemetry/opentelemetry-cpp/pull/4078 (opens in a new tab)x_refsource_MISC

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisories (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2026-44967](https://trackcve.app/badge/CVE-2026-44967.svg)](https://trackcve.app/cve/CVE-2026-44967)

Record last updated 12 Jun 2026, 16:10 UTC.