{"id":"EUVD-2026-29706","revision":"3f315d393571457a95f8d96bb81ace07","records":[{"revision":"3f315d393571457a95f8d96bb81ace07","observedAt":"2026-11-05T09:02:17.268+00:00","statement":{"source":"euvd","id":"EUVD-2026-29706","aliases":["CVE-2026-42348","GHSA-w2jh-77fq-7gp8"],"title":"OpenTelemetry.OpAmp.Client is the OpAMP client for OpenTelemetry .NET. Prior to 0.2.0-alpha.1, when receiving responses from the OpAMP server over HTTP, the OpAMP client allocates an unbounded buffer to read all bytes from the server, with …","description":"OpenTelemetry.OpAmp.Client is the OpAMP client for OpenTelemetry .NET. Prior to 0.2.0-alpha.1, when receiving responses from the OpAMP server over HTTP, the OpAMP client allocates an unbounded buffer to read all bytes from the server, with no upper-bound on the number of bytes consumed. This could cause memory exhaustion in the consuming application if the configured OpAMP server is attacker-controlled (or a network attacker can MitM the connection) and an extremely large body is returned in the response. This vulnerability is fixed in 0.2.0-alpha.1.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","score":5.9,"severity":null}],"references":["https://github.com/open-telemetry/opentelemetry-dotnet-contrib/security/advisories/GHSA-w2jh-77fq-7gp8","https://github.com/open-telemetry/opentelemetry-dotnet-contrib/pull/4116"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-29706","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"May 12, 2026, 6:01:41 PM","dateUpdated":"May 13, 2026, 7:32:28 PM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-29706","identifiers":["EUVD-2026-29706","CVE-2026-42348","GHSA-w2jh-77fq-7gp8"]},"retained":false,"historicalAffected":[]}],"coverage":[]}