{"id":"EUVD-2026-32538","enisaUuid":"199e117b-f059-3ff5-b6ed-7f3936d5afc6","description":"opentelemetry-js is the OpenTelemetry JavaScript Client. Prior to 0.217.0, a single malformed HTTP request crashes any Node.js process running the OpenTelemetry JS Prometheus exporter. The metrics endpoint (default 0.0.0.0:9464) has no error handling around URL parsing, so a request with an invalid URI causes an uncaught TypeError that terminates the process. This vulnerability is fixed in 0.217.0.","datePublished":"May 27, 2026, 2:49:04 PM","dateUpdated":"May 28, 2026, 3:26:13 PM","baseScore":7.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","references":"https://github.com/open-telemetry/opentelemetry-js/security/advisories/GHSA-q7rr-3cgh-j5r3\n","aliases":"CVE-2026-44902\nGHSA-q7rr-3cgh-j5r3\n","assigner":"GitHub_M","epss":0.47,"enisaIdProduct":[{"id":"1a97df9c-54dd-3c2b-b90f-18cceb721950","product":{"name":"auto-instrumentations-node","vendor":{"name":"@opentelemetry"}},"product_version":"\u003c 0.75.0"},{"id":"b87aa763-f99b-3d10-b9a0-cdab98f8f6c2","product":{"name":"sdk-node","vendor":{"name":"@opentelemetry"}},"product_version":"\u003c 0.217.0"},{"id":"e757d07c-7945-3350-93c6-631f4294bdf5","product":{"name":"opentelemetry-js","vendor":{"name":"open-telemetry"}},"product_version":"\u003c 0.217.0"},{"id":"fdf8646b-c229-3e9d-aea9-8642f9a9dfce","product":{"name":"exporter-prometheus","vendor":{"name":"@opentelemetry"}},"product_version":"\u003c 0.217.0"}],"enisaIdVendor":[{"id":"2d4303e2-1cfb-318b-b915-79f13dcf7c96","vendor":{"name":"@opentelemetry"}},{"id":"d2c350c8-507b-37a6-a532-89536f5108ee","vendor":{"name":"open-telemetry"}}],"enisaIdVulnerability":[{"id":"62929e5f-8ec5-3a0d-836a-48a3fbb7d4a7","vulnerability":{"id":"CVE-2026-44902","description":"opentelemetry-js is the OpenTelemetry JavaScript Client. Prior to 0.217.0, a single malformed HTTP request crashes any Node.js process running the OpenTelemetry JS Prometheus exporter. The metrics endpoint (default 0.0.0.0:9464) has no error handling around URL parsing, so a request with an invalid URI causes an uncaught TypeError that terminates the process. This vulnerability is fixed in 0.217.0.","datePublished":"May 27, 2026, 2:49:04 PM","dateUpdated":"May 28, 2026, 3:26:13 PM","status":"PUBLISHED","baseScore":7.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","references":"https://github.com/open-telemetry/opentelemetry-js/security/advisories/GHSA-q7rr-3cgh-j5r3\n","enisa_id":"EUVD-2026-32538\n","assigner":"GitHub_M","epss":0.47,"dataProcessed":"Nov 7, 2026, 7:21:46 AM","vulnerabilityProduct":[{"id":"0b463431-d7a1-32b6-9b46-5a320bf644bd","product":{"name":"opentelemetry-js","vendor":{"name":"open-telemetry"}},"product_version":"\u003c 0.217.0"},{"id":"1a896be6-6f18-3aa0-8342-253a5a47490b","product":{"name":"exporter-prometheus","vendor":{"name":"@opentelemetry"}},"product_version":"\u003c 0.217.0"},{"id":"958340ff-5449-30be-8aea-0b3c77425c06","product":{"name":"auto-instrumentations-node","vendor":{"name":"@opentelemetry"}},"product_version":"\u003c 0.75.0"},{"id":"b6a8112c-76cd-3745-838d-1047c6e97569","product":{"name":"sdk-node","vendor":{"name":"@opentelemetry"}},"product_version":"\u003c 0.217.0"}],"vulnerabilityVendor":[{"id":"ed96e579-fc8c-390a-ac3a-597df0f626b0","vendor":{"name":"open-telemetry"}},{"id":"f376af67-e447-374f-82c0-355dfd2ab126","vendor":{"name":"@opentelemetry"}}]}},{"id":"980d569f-2fdb-39b0-8210-f7109ca0cd53","vulnerability":{"id":"GHSA-q7rr-3cgh-j5r3","description":"Prometheus exporter process crash via malformed HTTP request","datePublished":"May 11, 2026, 2:42:10 PM","dateUpdated":"Oct 19, 2026, 7:35:38 PM","baseScore":0.0,"references":"https://github.com/open-telemetry/opentelemetry-js/security/advisories/GHSA-q7rr-3cgh-j5r3\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-44902\nhttps://github.com/github/advisory-database/pull/10226\nhttps://github.com/open-telemetry/opentelemetry-js\nhttps://github.com/open-telemetry/opentelemetry-js-contrib/blob/3ef5205e5353010184c69ff7b9f0f4830f0932de/metapackages/auto-instrumentations-node/package.json#L95\nhttps://github.com/open-telemetry/opentelemetry-js/blob/616d27a0a111c9b813d14c56d8d8f1ffbd7d7156/experimental/packages/opentelemetry-sdk-node/package.json#L55\n","enisa_id":"EUVD-2026-32538\n","aliases":"GHSA-q7rr-3cgh-j5r3\nCVE-2026-44902\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:00:21 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[{"id":"0c7475a8-6c7a-3eae-8541-494f11a5b6f8","advisory":{"id":"RHSA-2026:51162","description":"Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.2 security update","summary":"Updated images are now available for Red Hat Ansible Automation Platform 2.2, which include new features, bug fixes, and enhancements for the Red Hat Ansible Automation Portal bootable container image.","datePublished":"Aug 6, 2026, 3:37:13 PM","dateUpdated":"Oct 31, 2026, 3:41:17 PM","baseScore":0.0,"references":"https://access.redhat.com/errata/RHSA-2026:51162\nhttps://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_51162.json\n","aliases":"CVE-2026-13149\nCVE-2026-44902\nCVE-2026-45740\nCVE-2026-48068\nCVE-2026-48801\nCVE-2026-59873\nCVE-2026-59877\n","source":{"id":9,"name":"csaf_redhat"},"advisoryProduct":[{"id":"27b1cafb-e2d3-343c-bfdf-1d8da7ba58ac","product":{"name":"registry.redhat.io/ansible-automation-platform/bootc-automation-portal-rhel9@sha256:53d3067ffe63c784ee1c8b22b4acb0eb50b71814ca4c13e14edfce31b5feabbe_amd64","vendor":{"name":"Red Hat"}}},{"id":"91711d8a-5022-387b-a589-253e82aff38b","product":{"name":"Red Hat Ansible Automation Platform 2.2","vendor":{"name":"Red Hat"}}}]}},{"id":"cf6b47cf-fe33-3fc7-aefe-460003cf4d20","advisory":{"id":"RHSA-2026:41929","description":"Red Hat Security Advisory: Red Hat Developer Hub 1.9.7 release.","summary":"Red Hat Developer Hub 1.9.7 has been released.","datePublished":"Jul 20, 2026, 8:34:32 AM","dateUpdated":"Oct 31, 2026, 3:41:15 PM","baseScore":0.0,"references":"https://access.redhat.com/errata/RHSA-2026:41929\nhttps://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_41929.json\n","aliases":"CVE-2026-6734\nCVE-2026-9697\nCVE-2026-12143\nCVE-2026-12151\nCVE-2026-13676\nCVE-2026-42504\nCVE-2026-44902\nCVE-2026-45740\n","source":{"id":9,"name":"csaf_redhat"},"advisoryProduct":[{"id":"54f41308-cb7e-3559-aa93-d62b7e46e14d","product":{"name":"Red Hat Developer Hub 1.9","vendor":{"name":"Red Hat"}}},{"id":"b5accbe7-7606-3b89-95e9-347c822a209b","product":{"name":"registry.redhat.io/rhdh/rhdh-operator-bundle@sha256:c26504289ade9a1e816d18cd94af9b6a47fb7ffe66185679d0527376fb505486_amd64","vendor":{"name":"Red Hat"}}},{"id":"bbda4c5f-2d3c-34ca-99ef-1be4e83c5574","product":{"name":"registry.redhat.io/rhdh/rhdh-rhel9-operator@sha256:b1ee0b75525f1873a1ba066102043a8bd28a5867d4d077fefff34444a658e473_amd64","vendor":{"name":"Red Hat"}}},{"id":"ee87d3ab-94fc-3654-9771-5faab2318159","product":{"name":"registry.redhat.io/rhdh/rhdh-hub-rhel9@sha256:923a9219b3efa5535b7f0b5aec597f04d66c2edb9a3bea4c70c0273cea5be382_amd64","vendor":{"name":"Red Hat"}}}]}}]}