← Vulnerability feed

Vulnerability record · CVE-2023-47108 · published 10 November 2023

CVE-2023-47108: Opentelemetry allocation without limits vulnerability

Opentelemetry · Opentelemetry

OpenTelemetry-Go Contrib is a collection of third-party packages for OpenTelemetry-Go. Starting in version 0.37.0 and prior to version 0.46.0, the grpc Unary Server Interceptor out of the box adds labels `net.peer.sock.addr` and `net.peer.sock.port` that have unbound cardinality. It leads to the server's potential memory exhaustion when many malicious requests are sent. An attacker can easily flood the peer address and port for requests. Version 0.46.0 contains a fix for this issue. As a workaround to stop being affected, a view removing the attributes can be used. The other possibility is to disable grpc metrics instrumentation by passing `otelgrpc.WithMeterProvider` option with `noop.NewMeterProvider`.

7.5 CVSS 3.1 High EPSS 1.6% · top 25.3% CWE-770 · Allocation without limits
7.5CVSS 3.1 base score
1.6%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
13References
17 Jun 2026Last modified by NVD

Description

OpenTelemetry-Go Contrib is a collection of third-party packages for OpenTelemetry-Go. Starting in version 0.37.0 and prior to version 0.46.0, the grpc Unary Server Interceptor out of the box adds labels `net.peer.sock.addr` and `net.peer.sock.port` that have unbound cardinality. It leads to the server's potential memory exhaustion when many malicious requests are sent. An attacker can easily flood the peer address and port for requests. Version 0.46.0 contains a fix for this issue. As a workaround to stop being affected, a view removing the attributes can be used. The other possibility is to disable grpc metrics instrumentation by passing `otelgrpc.WithMeterProvider` option with `noop.NewMeterProvider`.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/open-telemetry/opentelemetry-go-contrib/blob/9d4eb7e7706038b07d33f83f76afbe13f53d171d/instrumentation Product
https://github.com/open-telemetry/opentelemetry-go-contrib/blob/instrumentation/google.golang.org/grpc/otelgrpc/v0.45.0/ Product
https://github.com/open-telemetry/opentelemetry-go-contrib/commit/04c5dcbb5b35f14b4e6793b245919c72addbc7d0
https://github.com/open-telemetry/opentelemetry-go-contrib/commit/b44dfc9092b157625a5815cb437583cee663333b Patch
https://github.com/open-telemetry/opentelemetry-go-contrib/pull/4322 Issue TrackingPatch
https://github.com/open-telemetry/opentelemetry-go-contrib/security/advisories/GHSA-8pgv-569h-w5rw Vendor Advisory
https://pkg.go.dev/go.opentelemetry.io/otel/metric/noop#NewMeterProvider Product
https://github.com/open-telemetry/opentelemetry-go-contrib/blob/9d4eb7e7706038b07d33f83f76afbe13f53d171d/instrumentation Product
https://github.com/open-telemetry/opentelemetry-go-contrib/blob/instrumentation/google.golang.org/grpc/otelgrpc/v0.45.0/ Product
https://github.com/open-telemetry/opentelemetry-go-contrib/commit/b44dfc9092b157625a5815cb437583cee663333b Patch
https://github.com/open-telemetry/opentelemetry-go-contrib/pull/4322 Issue TrackingPatch
https://github.com/open-telemetry/opentelemetry-go-contrib/security/advisories/GHSA-8pgv-569h-w5rw Vendor Advisory
https://pkg.go.dev/go.opentelemetry.io/otel/metric/noop#NewMeterProvider Product

Track CVE-2023-47108 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

7.5CVE-2026-29181Opentelemetry allocation without limits vulnerabilityOpenTelemetry-Go is the Go implementation of OpenTelemetry. From 1.36.0 to 1.40.0, multi-value baggage: header extraction parses each header field-va…EPSS 0.87%7.5CVE-2023-45142Opentelemetry allocation without limits vulnerabilityOpenTelemetry-Go Contrib is a collection of third-party packages for OpenTelemetry-Go. A handler wrapper out of the box adds labels `http.user_agent`…EPSS 1.4%7.5CVE-2023-43810Opentelemetry uncontrolled resource consumption vulnerabilityOpenTelemetry, also known as OTel for short, is a vendor-neutral open-source Observability framework for instrumenting, generating, collecting, and e…EPSS 0.69%7.3CVE-2026-39883Opentelemetry untrusted search path vulnerabilityOpenTelemetry-Go is the Go implementation of OpenTelemetry. From 1.15.0 to 1.42.0, the fix for CVE-2026-24051 changed the Darwin ioreg command to use…EPSS 0.21%7.0CVE-2026-24051Opentelemetry untrusted search path vulnerabilityOpenTelemetry-Go is the Go implementation of OpenTelemetry. The OpenTelemetry Go SDK in version v1.20.0-1.39.0 is vulnerable to Path Hijacking (Untru…EPSS 0.17%5.9CVE-2026-41078Opentelemetry allocation without limits vulnerabilityOpenTelemetry dotnet is a dotnet telemetry framework. In 1.6.0-rc.1 and earlier, OpenTelemetry.Exporter.Jaeger may allow sustained memory pressure wh…EPSS 0.37%5.9CVE-2026-40182Opentelemetry vulnerabilityOpenTelemetry dotnet is a dotnet telemetry framework. From 1.13.1 to before 1.15.2, When exporting telemetry to a back-end/collector over gRPC or HTT…EPSS 0.56%5.3CVE-2026-54285Opentelemetry allocation without limits vulnerabilityopentelemetry-js is the OpenTelemetry JavaScript Client. Prior to 2.8.0, W3CBaggagePropagator.extract() in @opentelemetry/core does not enforce size …EPSS 0.40%

Source: NIST National Vulnerability Database (record CVE-2023-47108), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.