{"id":"EUVD-2026-29706","enisaUuid":"11e65682-c541-3734-9411-75e96e599b16","description":"OpenTelemetry.OpAmp.Client is the OpAMP client for OpenTelemetry .NET. Prior to 0.2.0-alpha.1, when receiving responses from the OpAMP server over HTTP, the OpAMP client allocates an unbounded buffer to read all bytes from the server, with no upper-bound on the number of bytes consumed. This could cause memory exhaustion in the consuming application if the configured OpAMP server is attacker-controlled (or a network attacker can MitM the connection) and an extremely large body is returned in the response. This vulnerability is fixed in 0.2.0-alpha.1.","datePublished":"May 12, 2026, 6:01:41 PM","dateUpdated":"May 13, 2026, 7:32:28 PM","baseScore":5.9,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","references":"https://github.com/open-telemetry/opentelemetry-dotnet-contrib/security/advisories/GHSA-w2jh-77fq-7gp8\nhttps://github.com/open-telemetry/opentelemetry-dotnet-contrib/pull/4116\n","aliases":"CVE-2026-42348\nGHSA-w2jh-77fq-7gp8\n","assigner":"GitHub_M","epss":0.31,"enisaIdProduct":[{"id":"72c9ef81-faaa-336e-8343-c45237f9bbc8","product":{"name":"opentelemetry-dotnet-contrib","vendor":{"name":"open-telemetry"}},"product_version":"\u003c 0.2.0-alpha.1"}],"enisaIdVendor":[{"id":"2c10cd7b-5a2f-3d7e-abc8-e80287030d6d","vendor":{"name":"open-telemetry"}}],"enisaIdVulnerability":[{"id":"999f8d0f-9ca9-3cd2-9078-512349d3e390","vulnerability":{"id":"CVE-2026-42348","description":"OpenTelemetry.OpAmp.Client is the OpAMP client for OpenTelemetry .NET. Prior to 0.2.0-alpha.1, when receiving responses from the OpAMP server over HTTP, the OpAMP client allocates an unbounded buffer to read all bytes from the server, with no upper-bound on the number of bytes consumed. This could cause memory exhaustion in the consuming application if the configured OpAMP server is attacker-controlled (or a network attacker can MitM the connection) and an extremely large body is returned in the response. This vulnerability is fixed in 0.2.0-alpha.1.","datePublished":"May 12, 2026, 6:01:41 PM","dateUpdated":"May 13, 2026, 7:32:28 PM","status":"PUBLISHED","baseScore":5.9,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","references":"https://github.com/open-telemetry/opentelemetry-dotnet-contrib/security/advisories/GHSA-w2jh-77fq-7gp8\nhttps://github.com/open-telemetry/opentelemetry-dotnet-contrib/pull/4116\n","enisa_id":"EUVD-2026-29706\n","assigner":"GitHub_M","epss":0.31,"dataProcessed":"Nov 3, 2026, 7:17:08 AM","vulnerabilityProduct":[{"id":"7e23ee7e-16d7-3dcc-8216-ad8496712fd8","product":{"name":"opentelemetry-dotnet-contrib","vendor":{"name":"open-telemetry"}},"product_version":"\u003c 0.2.0-alpha.1"}],"vulnerabilityVendor":[{"id":"c40084e2-0477-316a-849a-34bec45caea2","vendor":{"name":"open-telemetry"}}]}},{"id":"b0a97c1a-39a9-35a8-b491-189631e6019b","vulnerability":{"id":"GHSA-w2jh-77fq-7gp8","description":"OpAMP client reads unbounded HTTP response bodies","datePublished":"May 5, 2026, 9:57:54 PM","dateUpdated":"May 13, 2026, 4:27:09 PM","baseScore":0.0,"references":"https://github.com/open-telemetry/opentelemetry-dotnet-contrib/security/advisories/GHSA-w2jh-77fq-7gp8\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-42348\nhttps://github.com/open-telemetry/opentelemetry-dotnet-contrib/pull/4116\nhttps://github.com/open-telemetry/opentelemetry-dotnet-contrib/commit/bf1fad4fa298ff451cda0efb0ee9c7a7eb46212a\nhttps://github.com/open-telemetry/opentelemetry-dotnet-contrib\n","enisa_id":"EUVD-2026-29706\n","aliases":"CVE-2026-42348\nGHSA-w2jh-77fq-7gp8\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:00:21 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}